CVE-2026-24936
Critical
Description
When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAsustor Data Master
PublishedFeb 3, 2026
First seenFeb 3, 2026
Weakness typeCWE-20Improper input validation
How to fix
Update
- asustor data_master5.1.2.re51 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asustor data_master | 4.1.0.rhu2 ≤ v ≤ 4.3.3.rof1, 5.0.0.ra82 ≤ v < 5.1.2.re51 | 5.1.2.re51 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.