CVE-2026-18188
Received Received - Intake

Format String Vulnerability in Asustor ADM Rsync Backup

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: ASUSTOR, Inc.

Description
A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected backup component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-18188
EUVD
EUVD-2026-50950

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
asustor adm From 4.1.0 (inc) to 4.3.3 (inc)
asustor adm From 5.0.0 (inc) to 5.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a format string vulnerability in the Rsync Backup feature of ASUSTOR ADM software. It allows an authenticated attacker to exploit improper handling of user-controlled input in format string operations. This could lead to memory disclosure or denial of service for the backup component.

Detection Guidance

Detecting this vulnerability requires checking the installed version of ADM on your Asustor NAS. Compare your version against the affected ranges: ADM 4.1.0 to 4.3.3.RUN1 and ADM 5.0.0 to 5.1.3.RI81. Use the ADM web interface or SSH to check the version via system settings or the 'cat /etc/version' command.

Impact Analysis

An attacker could exploit this to read sensitive memory information or crash the backup service, potentially disrupting data backup operations. Since it requires authentication, the risk is limited to authorized users or those who can gain access.

Mitigation Strategies

Immediately update ADM to a version outside the affected range. If an update is not available, disable rsync backup functionality temporarily until a patch is released. Monitor Asustor's official security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart