An HTTP header injection flaw in the start-page-loader.cgi component of the ADM web interface allows an unauthenticated attacker to send a crafted HTTP request that injects arbitrary headers via the state parameter. The injected headers trigger the underlying web server’s X‑Sendfile mechanism, enabling the attacker to read any file on the host system, including configuration files, credentials, or other sensitive data. The result is a direct compromise of confidentiality for the host, with no authentication or additional privileges required.

ASUSTOR Inc. ADM products are affected. The vulnerability exists from ADM 4.1.0 through 4.3.3.RWC1 and from ADM 5.0.0 through 5.1.4.RL21. Users running any of these versions without a patch are at risk.

The CVSS score of 9.2 rates this condition as critical, indicating full impact on confidentiality and the potential for unrestricted data leakage. EPSS data is not available, so the exact exploitation likelihood is unknown, but the lack of authentication requirements and the remote nature of the attack through standard HTTP traffic significantly raise the exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, but its severity and wide availability warrant immediate attention.