PT-2026-5771 · Asustor · Asustor Adm

Published 2026-02-03 · Updated 2026-03-12 · CVE-2026-24936

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 ASUSTOR ADM versions 5.0.0 through 5.1.1.RCI1

Description An improper input parameters validation issue exists in a specific CGI program when a particular function is enabled during Active Directory (AD) domain joining. This allows an unauthenticated remote attacker to write arbitrary data to any file on the system. Successful exploitation can lead to overwriting critical system files and complete system compromise.

Recommendations For ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1, disable the specific function used during AD domain joining. For ASUSTOR ADM versions 5.0.0 through 5.1.1.RCI1, disable the specific function used during AD domain joining.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-24936

Affected Products

Asustor Adm

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-24936 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24936 · Vendor Advisory
• https://asustor.com/security/security_advisory_detail?id=51 · Vendor Advisory
• https://twitter.com/Karma_X_Inc/status/2019115960330826127 · Twitter Post
• https://t.me/pentestingnews/72857 · Telegram Post
• https://twitter.com/CVEnew/status/2018554186049241370 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018537793698336794 · Twitter Post
• https://twitter.com/CCBalert/status/2018780979884597357 · Twitter Post
• https://t.me/CVEtracker/43565 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2018555964182437926 · Twitter Post
• https://t.me/cveNotify/150682 · Telegram Post
• https://twitter.com/Komodosec/status/2032110018796142929 · Twitter Post