CVE-2026-67247 Overview
CVE-2026-67247 is a path traversal vulnerability [CWE-22] in the IHM Log handling component of Asustor Data Master (ADM). The flaw exists because user-controlled disk serial input is not validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this weakness to force the affected component to access an unintended filesystem path or log database file. Affected releases include ADM 4.1.0 through ADM 4.3.3.RUN1, and ADM 5.0.0 through ADM 5.1.3.RI81.
Critical Impact
Authenticated attackers can traverse the ADM filesystem through unsanitized disk serial input, exposing log database files outside the intended directory.
Affected Products
- Asustor ADM 4.1.0 through 4.3.3.RUN1
- Asustor ADM 5.0.0 through 5.1.3.RI81
- IHM Log handling component within ADM
Discovery Timeline
- 2026-07-30 - CVE-2026-67247 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-67247
Vulnerability Analysis
The vulnerability resides in ADM's IHM (I/O Health Monitor) Log handling logic. ADM uses the disk serial number as part of the path used to locate or open the IHM log database file. Because the disk serial value is accepted from an authenticated user context without sufficient validation, an attacker can supply a crafted value containing path traversal sequences. The affected component then resolves the constructed path outside the intended log directory, causing it to open, read, or interact with an arbitrary file on the device's filesystem. The issue is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The root cause is missing canonicalization and allow-list validation of the disk serial input before string concatenation into a filesystem path. Traversal metacharacters such as ../ and absolute path prefixes are not stripped or rejected. This allows the resolved path to escape the intended IHM log directory.
Attack Vector
Exploitation requires network access to ADM and authenticated credentials with low privileges. The attacker submits a manipulated disk serial value to the IHM log interface, causing the log-handling routine to construct a path that references an unintended file. No user interaction is required. Refer to the Asustor Security Advisory #68 for vendor-supplied technical detail.
Detection Methods for CVE-2026-67247
Indicators of Compromise
- ADM audit or web logs showing IHM Log requests containing ../, ..\, or absolute path sequences in disk serial parameters.
- Access attempts to IHM log database files referencing paths outside the standard IHM log directory.
- Authenticated sessions from unexpected sources issuing repeated IHM log queries with anomalous serial values.
Detection Strategies
- Inspect ADM HTTP request logs for disk serial parameters that do not match the expected alphanumeric serial format.
- Correlate authenticated user activity with file access patterns targeting non-IHM paths.
- Alert on IHM Log handler errors indicating failed file opens on paths outside the designated log directory.
Monitoring Recommendations
- Enable and forward ADM system and web access logs to a central log platform for retention and analysis.
- Baseline normal disk serial values reported by ADM and flag deviations from that character set or length.
- Monitor authentication events on ADM for unexpected low-privileged account activity that precedes IHM log requests.
How to Mitigate CVE-2026-67247
Immediate Actions Required
- Upgrade ADM to a fixed release above 4.3.3.RUN1 on the 4.x branch or above 5.1.3.RI81 on the 5.x branch, as directed by Asustor Security Advisory #68.
- Restrict ADM management interface exposure to trusted networks and remove any public internet exposure.
- Review and rotate credentials for all authenticated ADM accounts, especially low-privileged users that can reach the IHM Log interface.
Patch Information
Asustor has published guidance in Security Advisory #68. Administrators should apply the ADM update that supersedes versions 4.3.3.RUN1 and 5.1.3.RI81. Confirm the running firmware version through ADM's system information panel after upgrade.
Workarounds
- Limit access to the ADM web interface using firewall rules or VPN-only reachability until patching is complete.
- Disable or restrict accounts that do not require access to IHM Log functionality.
- Audit existing IHM log files and directories for signs of unauthorized access prior to remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
