CVE-2026-105324
Received Received - Intake

HTTP Header Injection in ASUSTOR ADM via start-page-loader.cgi

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: ASUSTOR, Inc.

Description
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-105324
EUVD
EUVD-2026-94153

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ASUSTOR Inc. ADM 5.0.0
ASUSTOR Inc. ADM 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an HTTP header injection vulnerability in start-page-loader.cgi of ADM software. An unauthenticated remote attacker can send a crafted HTTP request with injected headers via the state parameter to read arbitrary files on the host system by exploiting the web server's X-Sendfile mechanism.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP requests targeting start-page-loader.cgi with unusual or crafted headers via the state parameter. Check web server logs for X-Sendfile responses or unauthorized file access attempts.

Impact Analysis

This vulnerability allows attackers to access sensitive files on your system without authentication. This could lead to exposure of confidential data, system configuration files, or other sensitive information stored on the device.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR, HIPAA, or other compliance requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this issue.

Mitigation Strategies

Immediately upgrade ADM to version 5.1.4.RM62 or later, or 4.3.3.RY62 or later. If upgrading is not possible, restrict access to start-page-loader.cgi and disable the X-Sendfile feature on the web server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart