PT-2026-5771 · Asustor · Asustor Adm

CVE-2026-24936 · Publicado 2026-02-03 · Atualizado 2026-03-12

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 ASUSTOR ADM versions 5.0.0 through 5.1.1.RCI1

Description An improper input parameters validation issue exists in a specific CGI program when a particular function is enabled during Active Directory (AD) domain joining. This allows an unauthenticated remote attacker to write arbitrary data to any file on the system. Successful exploitation can lead to overwriting critical system files and complete system compromise.

Recommendations For ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1, disable the specific function used during AD domain joining. For ASUSTOR ADM versions 5.0.0 through 5.1.1.RCI1, disable the specific function used during AD domain joining.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-24936

Produtos afetados

Asustor Adm

Referências · 12

• https://twitter.com/Karma_X_Inc/status/2019115960330826127 · Publicação no Twitter
• https://t.me/pentestingnews/72857 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24936 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24936 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2018554186049241370 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2018537793698336794 · Publicação no Twitter
• https://asustor.com/security/security_advisory_detail?id=51 · Aviso do Fabricante
• https://twitter.com/CCBalert/status/2018780979884597357 · Publicação no Twitter
• https://t.me/CVEtracker/43565 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2018555964182437926 · Publicação no Twitter
• https://t.me/cveNotify/150682 · Publicação no Telegram
• https://twitter.com/Komodosec/status/2032110018796142929 · Publicação no Twitter