A buffer overflow in the VPN Clients on the ADM is caused by an unbounded sscanf and unsafe printf usage. The lack of PIE and stack canaries allows an authenticated remote attacker to supply crafted input and execute arbitrary code as the web server user. The flaw grants full control over the system hosting the ADM, enabling the attacker to run commands, install malware, or pivot to other network assets.

The vulnerability affects ASUSTOR Inc. Advanced Data Manager (ADM) devices running firmware versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1. Users of these firmware releases are at risk unless updated beyond the listed versions.

The CVSS base score is 8.6, indicating a high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated remote access to the ADM, typically through the VPN client or web interface, and the attacker must send payloads that trigger the overflow. Once executed, the attacker gains code execution privileges as the web server user, potentially compromising the entire system.