Format String Vulnerability in ASUSTOR ADM

Executive Summary

This is a format string vulnerability in the Internal Backup feature of ASUSTOR NAS devices running ADM versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81. An authenticated attacker can exploit it by providing malicious input that gets processed through an unsafe format string operation in error responses. This may lead to memory disclosure or denial of service for the affected CGI process.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive memory information from the device or crash the backup service, causing temporary unavailability. Since it requires authentication, the attacker must first gain access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized memory disclosure, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if such data is stored on the affected device.

Useful 0 Not Useful 0

Mitigation Strategies

Update ADM to a version outside the affected range (4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81). If immediate update is not possible, restrict access to authenticated users only and monitor for suspicious activity in the Internal Backup feature.

Useful 0 Not Useful 0