CVE-2026-18186

Analyzed Analyzed - Analysis Complete

Stored Format String in ASUSTOR ADM FTP Backup

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: ASUSTOR, Inc.

Description

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18186

EUVD

EUVD-2026-50957

Affected Vendors & Products

Vendor	Product	Version / Range
asustor	data_master	From 4.1.0.rhu2 (inc) to 4.3.3.run1 (inc)
asustor	data_master	From 5.0.0.ra82 (inc) to 5.1.4.rjv2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

CVE-2026-18186 is a stored format string vulnerability in ASUSTOR NAS devices running ADM versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81. It affects the FTP Backup feature where user-controlled backup configuration data is written into a task log and later processed through an unsafe format string operation.

Detection Guidance

To detect this vulnerability, check if your ASUSTOR NAS device is running ADM versions between 4.1.0 to 4.3.3.RUN1 or 5.0.0 to 5.1.3.RI81. Inspect FTP Backup configuration logs for unusual format string patterns or memory disclosure signs.

Impact Analysis

An authenticated attacker could exploit this vulnerability to disclose memory information or cause a denial of service in the affected CGI process. This could lead to unauthorized access to sensitive data or disruption of services.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to memory information or disrupting services. Stored format string flaws may lead to information disclosure, which could violate data protection requirements under these regulations. Denial of service could also disrupt operations handling sensitive data.

Mitigation Strategies

Immediately update ADM to the latest patched version. Disable the FTP Backup feature if not in use. Restrict authenticated user access to the least privileges required. Monitor CGI process logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-18186. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70