A stack-based buffer overflow exists in the File Explorer component of ASUSTOR Devicemanagement (ADM). User-controlled data is copied into a fixed-size stack buffer without proper validation, allowing an authenticated attacker to trigger an overflow. Exploitation leads to a denial of service of the affected CGI process, as the overflow corrupts the stack and crashes the process. The description notes that further impact may be possible if runtime protections are bypassed, but the primary consequence disclosed is a DoS.

Affected are ASUSTOR Inc. ADM systems. Vulnerable versions are ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. No other vendors or product line is listed.

The CVSS score of 8.7 classifies this as a high severity vulnerability. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild at this time. It is not listed in CISA’s KEV catalog. Exploitation requires authentication and local network or system access, as the attacker must supply malicious input to the vulnerable File Explorer CGI. If resolved, the attack would simply crash the CGI process; if not, an attacker could potentially chain exploitation to achieve additional privilege or system takeover depending on runtime defenses.