ASUSTOR ADM Multiple Format String Vulnerabilities (CVE-2026-18186/18187/18188/67244)

Vulnerability Overview Multiple format string vulnerabilities were discovered in ASUSTOR's ADM (ASUSTOR Data Master), specifically affecting FTP backup, internal backup, Rsync backup, and notification settings. These vulnerabilities allow authenticated attackers to exploit unsafe format string operations to leak memory information or cause a denial of service for the affected CGI processes. Affected Products Affected Products and Versions: - ADM 4.1.0 through ADM 4.3.3.RUN1 - ADM 5.0.0 through ADM 5.1.3.RI81 Remediation Status Remediation Status: In Progress Affected Products: - ADM 5.0 and 5.1 - ADM 4.3, 4.2, and 4.1 Detailed Information CVE-2026-18186 Severity: High CVSS4 Base Score: 7.1 CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VC:H/VA:H/SC:N/SI:N/SA:N Description: A format string vulnerability was identified in the FTP backup feature. Because user-controlled backup configuration data can be written to task logs and processed via unsafe format string operations, an attacker can leverage this issue to leak memory information or cause a denial of service for the affected CGI process. CVE-2026-18187 Severity: High CVSS4 Base Score: 7.1 CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VC:H/VA:H/SC:N/SI:N/SA:N Description: A format string vulnerability was identified in the internal backup feature. Because user-controlled task inputs may be included in error responses and processed via unsafe format string operations, an attacker can leverage this issue to leak memory information or cause a denial of service for the affected CGI process. CVE-2026-18188 Severity: High CVSS4 Base Score: 7.1 CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VC:H/VA:H/SC:N/SI:N/SA:N Description: A format string vulnerability was identified in the Rsync backup feature. Because user-controlled Rsync backup configurations or log data can be processed via unsafe format string operations, an attacker can leverage this issue to leak memory information or cause a denial of service for the affected component. CVE-2026-67244 Severity: High CVSS4 Base Score: 8.6 CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VC:H/VA:H/SC:N/SI:N/SA:N Description: A format string vulnerability was identified in the notification OAuth settings. Because user-controlled notification configuration inputs can be processed via unsafe format string operations, an authenticated administrator can leverage this issue to leak memory information or cause a denial of service for the affected component. References CVE-2026-18186 CVE-2026-18187 CVE-2026-18188 CVE-2026-67244 Credits Credit to Jincheng Wang (@wnmt) from Nanjing University of Posts and Telecommunications (NJUPT) for the contribution. Revision History Proof of Concept (PoC) or Exploit Code No specific PoC code or exploit code is provided in this document.

Goal Reached Thanks to every supporter — we hit 100%!

ASUSTOR ADM Multiple Format String Vulnerabilities (CVE-2026-18186/18187/18188/67244)