ASUSTOR Fixes Critical ADM Flaw CVE-2026-105324 That Lets Attackers Read NAS Files Without Login
Do Son 
TL;DR
ASUSTOR has patched CVE-2026-105324, a critical ASUSTOR ADM vulnerability with a CVSS 4.0 score of 9.2. The flaw lets an unauthenticated remote attacker read arbitrary files on a NAS device. Owners should upgrade to ADM 5.1.4.RM62 or ADM 4.3.3.RY62.
- CVE: CVE-2026-105324
- CVSS: 9.2 (Critical · CVSSv4)
- Product: ASUSTOR Inc. ADM
- Affected: 5.0.0, 4.1.0
- Impact: An HTTP header injection vulnerability was found in the ADM
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Too many alerts in your inbox? Switch to one weekly digest, sorted by severity.
Try Team free for 14 daysWhy It Matters
ADM is the operating system on ASUSTOR network-attached storage devices. People use these boxes to store backups, media and business files. Many owners also expose them to the internet for remote access.
Notably, the advisory rates the overall issue as Important, while the CVE entry itself is marked Critical. This bug needs no login and no user interaction. As a result, any reachable device is at risk. ASUSTOR’s advisory does not report any exploitation in the wild or a public proof-of-concept.
How the Attack Works
The flaw sits in a script called start-page-loader.cgi. According to ASUSTOR security advisory AS-2026-022, it is “an HTTP header injection vulnerability” that allows an attacker “to read arbitrary files on the host system.”
In short, the script fails to clean input in one of its parameters. An attacker can slip extra headers into the server’s response. Those headers then abuse the web server’s X-Sendfile feature, which serves files straight from disk. ASUSTOR says the attacker can “retrieve sensitive files without authentication.”
Affected Versions
This ASUSTOR ADM vulnerability affects two release lines:
- ADM 4.1.0 through ADM 4.3.3.RWC1
- ADM 5.0.0 through ADM 5.1.4.RL21
Patch and Mitigation Steps
Upgrade to ADM 5.1.4.RM62 or later on the 5.x branch. On the 4.x branch, install ADM 4.3.3.RY62 or later. You can update through the ADM control panel or download firmware from ASUSTOR.
Until you patch, avoid exposing the ADM web interface to the internet. Instead, reach the device over a VPN. These steps cut the risk while you close this ASUSTOR ADM vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
