# cve.now: Asustor

The newest entries naming Asustor as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-105324](https://cve.now/CVE-2026-105324.md): An HTTP header injection vulnerability was found in the ADM (CVSS 9.2)
- [CVE-2026-18759](https://cve.now/CVE-2026-18759.md): An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync. (CVSS 8.5)
- [CVE-2026-67248](https://cve.now/CVE-2026-67248.md): A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM (CVSS 8.7)
- [CVE-2026-67247](https://cve.now/CVE-2026-67247.md): A path traversal vulnerability was found in the IHM Log handling of ADM (CVSS 7.1)
- [CVE-2026-67246](https://cve.now/CVE-2026-67246.md): A path traversal vulnerability was found in the Wallpaper component of ADM (CVSS 6.9)
- [CVE-2026-67245](https://cve.now/CVE-2026-67245.md): A path traversal vulnerability was found in the VPN Clients on the ADM (CVSS 7.0)
- [CVE-2026-67244](https://cve.now/CVE-2026-67244.md): A format string vulnerability was found in the Notification OAuth settings of ADM (CVSS 8.6)
- [CVE-2026-18188](https://cve.now/CVE-2026-18188.md): A format string vulnerability was found in the Rsync Backup on the ADM (CVSS 7.1)
- [CVE-2026-18187](https://cve.now/CVE-2026-18187.md): A format string vulnerability was found in the Internal Backup on the ADM (CVSS 7.1)
- [CVE-2026-18186](https://cve.now/CVE-2026-18186.md): A stored format string vulnerability was found in the FTP Backup on the ADM (CVSS 7.1)
- [CVE-2026-6644](https://cve.now/CVE-2026-6644.md): A command injection vulnerability was found in the PPTP VPN Clients on the ADM (CVSS 9.4)
- [CVE-2026-6643](https://cve.now/CVE-2026-6643.md): A stack-based buffer overflow vulnerability in the VPN Clients on the ADM (CVSS 8.6)
- [CVE-2026-3179](https://cve.now/CVE-2026-3179.md): A path traversal vulnerability was found in the FTP Backup on the ADM. (CVSS 9.2)
- [CVE-2026-3100](https://cve.now/CVE-2026-3100.md): An improper certificate validation vulnerability was found in the FTP Backup on the ADM. (CVSS 8.3)
- [CVE-2026-24936](https://cve.now/CVE-2026-24936.md): An improper input validation vulnerability was found in ADM while joining a AD Domain. (CVSS 9.5)
- [CVE-2026-24935](https://cve.now/CVE-2026-24935.md): An improper certificate validation vulnerability was found in a third-party NAT traversal module. (CVSS 6.3)
- [CVE-2026-24934](https://cve.now/CVE-2026-24934.md): An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address. (CVSS 6.3)
- [CVE-2026-24933](https://cve.now/CVE-2026-24933.md): An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server. (CVSS 8.9)
- [CVE-2026-24932](https://cve.now/CVE-2026-24932.md): An improper certificate validation vulnerability was found in ADM while updating the DDNS settings. (CVSS 8.9)
- [CVE-2025-13053](https://cve.now/CVE-2025-13053.md): A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM (CVSS 7.0)
- [CVE-2025-13052](https://cve.now/CVE-2025-13052.md): An improper certificates validation vulnerability was found in the Notification settings of ADM (CVSS 7.0)
- [CVE-2025-13051](https://cve.now/CVE-2025-13051.md): Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges (CVSS 9.3)
- [CVE-2025-8070](https://cve.now/CVE-2025-8070.md): Windows service registered with an unquoted ImagePath vulnerability in the system registry (CVSS 9.2)
- [CVE-2025-7699](https://cve.now/CVE-2025-7699.md): An improper access control vulnerability was found in the EZ Sync Manager of ADM (CVSS 7.1)
- [CVE-2025-7618](https://cve.now/CVE-2025-7618.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADM (CVSS 4.8)
- [CVE-2025-7380](https://cve.now/CVE-2025-7380.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM (CVSS 4.8)
- [CVE-2025-7379](https://cve.now/CVE-2025-7379.md): A security bypass vulnerability was found in DataSync Center installed on ADM (CVSS 5.2)
- [CVE-2025-7378](https://cve.now/CVE-2025-7378.md): An improper input validation vulnerability was found on manipulating configuration of ADM (CVSS 6.0)
- [CVE-2023-4475](https://cve.now/CVE-2023-4475.md): An Arbitrary File Movement vulnerability was found on the ADM (CVSS 7.5)
- [CVE-2023-3699](https://cve.now/CVE-2023-3699.md): An Improper Privilege Management vulnerability was found on the ADM (CVSS 8.7)
- [CVE-2023-3698](https://cve.now/CVE-2023-3698.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.5)
- [CVE-2023-3697](https://cve.now/CVE-2023-3697.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.5)
- [CVE-2023-2910](https://cve.now/CVE-2023-2910.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.8)
- [CVE-2023-2909](https://cve.now/CVE-2023-2909.md): A Directory traversal vulnerability was found on EZ Sync service of ADM (CVSS 8.5)
- [CVE-2023-2749](https://cve.now/CVE-2023-2749.md): A Gain Information vulnerability was found on Download Center. (CVSS 8.6)
- [CVE-2023-2509](https://cve.now/CVE-2023-2509.md): A Cross-Site Scripting(XSS) vulnerability was found on ADM (CVSS 7.1)
- [CVE-2023-30770](https://cve.now/CVE-2023-30770.md): A stack-based buffer overflow vulnerability was found in the ADM (CVSS 7.1)
- [CVE-2022-37398](https://cve.now/CVE-2022-37398.md): A stack-based buffer overflow vulnerability was found on ADM (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/asustor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.