CVE-2026-18186 Overview
CVE-2026-18186 is a stored format string vulnerability in the FTP Backup feature of ASUSTOR Data Master (ADM). User-controlled backup configuration data is written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit the flaw to disclose memory contents or crash the affected CGI process, resulting in denial of service. The vulnerability is tracked under CWE-134 (Use of Externally-Controlled Format String).
Critical Impact
Authenticated attackers can leak memory information or terminate the CGI process serving ADM web functionality, disrupting backup operations and NAS management.
Affected Products
- ASUSTOR ADM 4.1.0 through ADM 4.3.3.RUN1
- ASUSTOR ADM 5.0.0 through ADM 5.1.3.RI81
- FTP Backup component within ADM
Discovery Timeline
- 2026-07-30 - CVE-2026-18186 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18186
Vulnerability Analysis
The vulnerability resides in the FTP Backup functionality of the ADM operating system used on ASUSTOR NAS devices. When an authenticated user configures FTP Backup tasks, attacker-supplied fields from the backup configuration are stored and later written into a task log. The logging routine passes these attacker-controlled strings directly as the format argument to a printf-family function rather than as a data argument.
Because the format specifiers embedded in user input are interpreted by the C standard library, an attacker can supply conversion specifiers such as %s, %x, or %n to read arbitrary memory or trigger writes that destabilize the process. The stored nature of the flaw means the malicious payload persists in the configuration and is re-triggered whenever the log entry is generated or read.
Root Cause
The root cause is a failure to treat externally supplied data as untrusted input to formatted output functions. Instead of calling the logging routine with a fixed format string and passing user data as an argument (for example, fprintf(log, "%s", user_input)), the vulnerable code passes user-controlled data as the format string itself. This design fault is classified under CWE-134.
Attack Vector
Exploitation requires network access to the ADM web interface and valid low-privilege credentials. The attacker submits a crafted FTP Backup task containing format specifiers within configuration fields. When the CGI process logs the task, the specifiers are evaluated. Reading %x or %s sequences discloses stack or heap contents, while malformed pointer references cause the CGI process to terminate, producing a denial of service against ADM management endpoints.
No verified proof-of-concept code is publicly available.
Refer to the ASUSTOR Security Advisory for technical remediation details:
https://www.asustor.com/security/security_advisory_detail?id=67
Detection Methods for CVE-2026-18186
Indicators of Compromise
- FTP Backup task configurations containing format specifier tokens such as %s, %x, %n, or %p in name, path, or credential fields.
- Unexpected CGI process crashes or restarts on the ADM device correlated with backup task execution.
- Anomalous log entries under FTP Backup task logs containing memory addresses or garbled binary output.
Detection Strategies
- Inspect stored FTP Backup task configurations for characters and sequences consistent with format string payloads.
- Correlate authentication events for ADM accounts with subsequent backup configuration changes and CGI process errors.
- Baseline normal task log content and alert on entries containing non-printable data or hex-like tokens.
Monitoring Recommendations
- Forward ADM system and web server logs to a centralized logging platform for continuous analysis.
- Monitor for repeated CGI worker terminations on the NAS, which may indicate exploitation attempts.
- Track new low-privilege ADM account creation and audit their backup configuration activity.
How to Mitigate CVE-2026-18186
Immediate Actions Required
- Update ADM to a fixed release as identified in the ASUSTOR Security Advisory #67.
- Restrict administrative and backup configuration access on the NAS to trusted users only.
- Rotate credentials for any ADM account that has recently modified FTP Backup settings.
Patch Information
ASUSTOR has published remediation guidance in Security Advisory #67. Administrators should upgrade beyond ADM 4.3.3.RUN1 in the 4.x branch and beyond ADM 5.1.3.RI81 in the 5.x branch to receive the fix.
Workarounds
- Disable the FTP Backup feature until the device is patched if it is not required for operations.
- Remove ADM device management interfaces from direct internet exposure and place them behind a VPN or trusted network segment.
- Enforce strong, unique passwords and multi-factor authentication for all ADM accounts to reduce the pool of authenticated attackers.
# Example: block external access to ADM web/CGI ports at the perimeter firewall
# Adjust ports to match your ADM configuration
iptables -A INPUT -p tcp --dport 8000 -s <trusted_management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -s <trusted_management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
