An unvalidated certificate name input in the VPN client upload process on ASUSTOR’s ADM platform allows an authenticated user to construct a file path that escapes the intended VPN certificate directory. By exploiting this path‑traversal flaw, the attacker can upload arbitrary files to locations outside the designated directory, potentially placing executable payloads or modifying critical configuration files. The CWE‑22 designation indicates improper handling of user‑controlled file paths. If the VPN service runs with elevated privileges, the attacker could achieve code execution or privilege escalation, compromising the confidentiality, integrity, and availability of the system.

Affected systems are ASUSTOR Inc.’s ADM devices running firmware versions from 4.1.0 through 4.3.3.RUN1 and from 5.0.0 through 5.1.3.RI81. Devices within this range that expose the VPN certificate upload interface are susceptible.

The CVSS base score of 7 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, and the vulnerability is not yet catalogued in CISA’s KEV list. Exploitation requires authenticated access to the ADM system, making it an internal threat vector. Once authenticated, an attacker can leverage the traversal to write malicious files, and depending on filesystem permissions, could achieve arbitrary code execution or disrupt system operation.