Skip to content
CVE PROGRAM SOURCE RECORD9.5 Critical

CVE-2026-24936

An improper input validation vulnerability was found in ADM while joining a AD Domain.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR ADM

Default version status: unaffected

  • 4.1.0 to ≤ 4.3.3.ROF1affected
  • 5.0.0 to ≤ 5.1.1.RCI1affected

References