CVE-2026-67245

Analyzed Analyzed - Analysis Complete

Path Traversal in ASUSTOR ADM VPN Client

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: ASUSTOR, Inc.

Description

A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an uploaded certificate file outside the intended VPN certificate directory, subject to process privileges and filesystem permissions. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67245

EUVD

EUVD-2026-50962

Affected Vendors & Products

Vendor	Product	Version / Range
asustor	data_master	From 4.1.0.rhu2 (inc) to 4.3.3.run1 (inc)
asustor	data_master	From 5.0.0.ra82 (inc) to 5.1.4.rjv2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-67245 is a path traversal vulnerability in ASUSTOR's ADM software affecting VPN Clients. It occurs when user-controlled certificate name input is not properly validated before being used to build the upload destination path. An authenticated attacker can exploit this to write certificate files outside the intended directory, depending on system privileges and permissions.

Detection Guidance

Check VPN client logs for unusual certificate upload paths or files written outside the intended directory. Inspect filesystem permissions and process privileges for VPN-related services. Review network traffic for unauthorized file writes or access attempts.

Impact Analysis

An attacker could overwrite sensitive files, install malicious software, or disrupt services by placing files in unintended locations. This depends on the attacker's privileges and filesystem restrictions. The impact is limited to authenticated users with access to the VPN Clients component.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations must assess exposure and apply mitigations to maintain compliance.

Mitigation Strategies

Disable VPN client functionality if not in use. Restrict filesystem permissions for VPN services to limit write access. Monitor for suspicious file operations in VPN certificate directories. Apply vendor patches once available.

Hi! I’m here to help you understand CVE-2026-67245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70