CVE-2026-105324 ASUSTOR Inc. CVE debrief

Who should care

System administrators and security teams responsible for managing and securing ADM systems should assess exposure and prioritize patching. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is

Why it matters

The CVE-2026-105324 vulnerability in ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. System administrators and security teams should assess exposure, prioritize patching, and verify affected systems.

• Potential unauthorized file disclosure
• Possible data breaches due to sensitive file exposure
• Need for verification of affected systems and versions
• High priority for patching and remediation

Technical summary

The vulnerability is caused by an HTTP header injection issue in the start-page-loader.cgi of ADM, which allows an unauthenticated remote attacker to read arbitrary files on the host system. The vulnerability affects ADM versions from 4.1.0 through 4.3.3.RWC1 and from 5.0.0 through 5.1.4.RL21. The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. System administrators and security teams should assess exposure and prioritize patching. The vulnerability has a CVSS score of 9.2 and a severity of CRITICAL.

Defensive priority

High priority for patching and verifying affected systems

Recommended defensive actions

• Patch affected systems to version 4.3.3.RWC2 or later, or 5.1.4.RL22 or later
• Verify affected systems for exposure
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects ADM versions from 4.1.0 through 4.3.3.RWC1 and from 5.0.0 through 5.1.4.RL21. The CVE Program record and NVD vulnerability detail provide official information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.