Description
A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected backup component.
Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
Published: 2026-07-30
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the Rsync Backup component of ASUSTOR ADM devices, whereby user‑controlled configuration or log data is passed to an unsafe format string operation. An authenticated attacker can exploit this to leak memory contents or trigger a crash, resulting in memory disclosure or denial of service of the affected backup component.

Affected Systems

ASUSTOR Adm devices running firmware versions ADM 4.1.0 through ADM 4.3.3.RUN1 or ADM 5.0.0 through ADM 5.1.3.RI81 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate to high severity, and the very low EPSS score (<1%) suggests a low likelihood of exploitation at this time. However, because an attacker requires authenticated access to the backup configuration, the risk remains for organizations in environments where backup management users are widely distributed. The vulnerability is not currently listed in CISA’s KEV catalog.

Generated by OpenCVE AI on August 4, 2026 at 11:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued firmware or patch that resolves the unsafe format string in the Rsync Backup component.
  • Disable or restrict user‑controlled logging of backup data to prevent exploitation of user‑supplied strings.
  • Review and tighten permissions on the backup configuration interface, limiting access only to trusted administrators.
  • Monitor system logs for abnormal memory read attempts or repeated service restarts associated with the Rsync Backup process.

Generated by OpenCVE AI on August 4, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Asustor
Asustor adm
Vendors & Products Asustor
Asustor adm

Thu, 30 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Description A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected backup component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
Title A format string vulnerability was found in the Rsync Backup on the ADM
Weaknesses CWE-134
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Asustor Adm Data Master
cve-icon MITRE

Status: PUBLISHED

Assigner: ASUSTOR1

Published:

Updated: 2026-08-04T07:27:32.766Z

Reserved: 2026-07-29T01:38:53.717Z

Link: CVE-2026-18188

cve-icon Vulnrichment

Updated: 2026-07-30T13:21:17.811Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T03:16:24.503

Modified: 2026-08-04T14:16:14.717

Link: CVE-2026-18188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:00:10Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String