CVE-2026-67245: ADM VPN Clients Path Traversal Flaw

CVE-2026-67245 Overview

CVE-2026-67245 is a path traversal vulnerability [CWE-22] in the VPN Clients component of Asustor Data Master (ADM). The flaw stems from insufficient validation of user-supplied certificate name input, which is used to build the upload destination path. An authenticated attacker can write uploaded certificate files outside the intended VPN certificate directory. Successful exploitation depends on process privileges and filesystem permissions. Affected releases include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81.

Critical Impact
An authenticated attacker can place arbitrary files in unintended filesystem locations, potentially overwriting sensitive data or configuration and compromising integrity and availability of the ADM appliance.

Affected Products

Asustor ADM 4.1.0 through 4.3.3.RUN1
Asustor ADM 5.0.0 through 5.1.3.RI81
ADM VPN Clients component (certificate upload functionality)

Discovery Timeline

2026-07-30 - CVE-2026-67245 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67245

Vulnerability Analysis

The vulnerability resides in the VPN Clients feature on ADM. When a user uploads a certificate, the application accepts a certificate name from user input and concatenates it into a filesystem path used as the upload destination. The application does not sufficiently validate or canonicalize this input. An authenticated user can supply a name containing directory traversal sequences such as ../ to escape the intended VPN certificate directory. The resulting write occurs at an attacker-chosen location, bounded only by the privileges of the ADM process and the underlying filesystem permissions. This class of flaw is tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing input validation on the certificate name parameter before it is used to construct the destination path. The upload handler trusts the client-supplied string and does not enforce a canonical path that stays within the certificate storage directory. There is no allow-list of permitted characters, no rejection of traversal tokens, and no post-canonicalization check confirming the resolved path remains inside the intended base directory.

Attack Vector

Exploitation requires network access to the ADM management interface and valid authenticated credentials with permission to interact with the VPN Clients certificate upload workflow. The attacker submits a certificate upload request with a crafted name value containing traversal sequences. The uploaded file content is written to the attacker-chosen path. Depending on the target location, this can overwrite configuration files, drop executable content into paths consumed by other services, or corrupt data used by the VPN client, impacting integrity and availability. See the Asustor Security Advisory #68 for vendor-supplied technical details.

Detection Methods for CVE-2026-67245

Indicators of Compromise

Certificate files or unexpected files written outside the ADM VPN certificate storage directory.
Web or application logs showing certificate upload requests where the certificate name parameter contains ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute path prefixes.
Modification timestamps on system configuration files that correlate with authenticated VPN Client certificate upload events.

Detection Strategies

Inspect ADM application and web server logs for VPN certificate upload endpoints receiving parameters containing traversal patterns or unusual characters in the certificate name field.
Correlate authenticated session activity with filesystem write events outside the expected certificate directory using host-based file integrity monitoring.
Alert on newly created or modified files with non-standard extensions inside ADM system directories following a VPN configuration action.

Monitoring Recommendations

Enable verbose audit logging on the ADM management interface and forward logs to a centralized SIEM for retention and query.
Monitor authenticated administrative sessions for anomalous file upload activity, particularly to VPN-related endpoints.
Track integrity of critical ADM configuration and binary paths so any unexpected write triggered by certificate upload workflows is flagged for review.

How to Mitigate CVE-2026-67245

Immediate Actions Required

Upgrade ADM to a fixed release published by Asustor as described in the Asustor Security Advisory #68.
Restrict administrative access to the ADM management interface to trusted networks and management VLANs only.
Review and reduce the number of accounts with permission to upload VPN client certificates, applying least privilege.
Audit the ADM filesystem for files written outside the expected VPN certificate directory since the affected versions were deployed.

Patch Information

Asustor has published guidance and fixed versions in Security Advisory #68. Administrators running ADM 4.1.0 through 4.3.3.RUN1 or ADM 5.0.0 through 5.1.3.RI81 must update to the patched release identified in the vendor advisory. Verify the ADM version through the web console after upgrade to confirm the fixed build is running.

Workarounds

Disable the VPN Clients feature on ADM until the appliance is upgraded to a fixed version, where operational requirements allow.
Block external access to the ADM management interface using a network firewall so certificate upload endpoints are not reachable from untrusted networks.
Rotate credentials for any account with VPN configuration privileges and enforce multi-factor authentication where supported.

bash

# Configuration example
# Restrict ADM management interface exposure at the network edge
# Replace 10.0.0.0/24 with your trusted management subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP