The vulnerability stems from improper input validation in a CGI program that is triggered when a particular function is enabled during an AD Domain join operation in ADM. An attacker who can reach the ADM interface without authentication can supply crafted input, causing the CGI to write arbitrary data to any file on the underlying system. This allows overwriting critical system files, essentially granting full control over the NAS and leading to a complete system compromise. The weakness corresponds to CWE‑20: Improper Input Validation.

Products affected are ASUSTOR Advanced Data Master (ADM) versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.1.RCI1. These include the Data Master operating system shipped with ASUSTOR NAS devices and any installation that uses the vulnerable ADM versions listed.

The CVSS score of 9.5 reflects the high severity of the flaw. Although the EPSS score is below 1%, indicating a low current likelihood of exploitation, the vulnerability remains a critical risk because it can be abused remotely without authentication and the attacker does not need to perform any privilege escalation before the file overwrite occurs. The vulnerability is not listed in the CISA KEV catalog, but its potential for complete system compromise warrants immediate attention. The attack requires remote connectivity to the ADM management interface and activation of the vulnerable function during AD Domain join, after which the attacker can write to any file.