A stored format string bug was identified in the FTP Backup feature of ASUSTOR’s ADM firmware. When users create backup configurations, the data can be written directly into a task log and later processed by an unsafe format string operation. The weakness, classified as CWE‑134, allows an authenticated attacker to read arbitrary memory contents or trigger a crash of the CGI process, compromising confidentiality or availability. No unauthenticated access is required; the attacker must have credentials to the ADM web interface or related service.

ASUSTOR Inc. ADM firmware versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81 are affected. All deployments running these firmware releases are potentially vulnerable until updated to a non‑affected revision.

The CVSS score of 7.1 indicates a high severity that can lead to significant data exposure or service disruption. The EPSS score of less than 1% suggests the probability of exploitation is currently low, and the vulnerability is not yet listed in CISA’s KEV catalog. Because the flaw requires authenticated access, it is likely exploitable by an internal user or an attacker who has compromised credentials. Nonetheless, the impact warrants that affected systems be evaluated promptly for updated firmware and that the backup feature be disabled if not essential.