ASUSTOR ADM: HTTP header injection enables unauthenticated file read
Summary
An HTTP header injection in start-page-loader.cgi of ASUSTOR ADM allows an unauthenticated remote attacker to read arbitrary files on the NAS. The attacker sends a crafted request with injected headers via the state parameter and abuses the web server's X-Sendfile mechanism. No login or user interaction is required, so ADM devices reachable from untrusted networks are at risk, and files such as configuration files and credentials could be exposed.
Affected
- ADM 4.1.0 through 4.3.3.RWC1
- ADM 5.0.0 through 5.1.4.RL21
Fixed in
- ADM 5.1.4.RM62 or later (5.x branch)
- ADM 4.3.3.RY62 or later (4.x branch)
- Note: after upgrading to ADM 4.3.3, downgrading to a previous version is no longer possible.
Workaround
- Unknown. The vendor advisory lists no workaround.
- Restrict access to the ADM web interface by firewall or VPN, and disable remote/WAN access until patched.
- Disabling or restricting X-Sendfile in the web server is suggested by a third party, but could not be confirmed as configurable on ADM; test before relying on it.
Exploitation
- No exploitation in the wild or public proof-of-concept reported by the vendor or sources found.
- CISA SSVC: exploitation none, automatable yes.
- Not listed in CISA KEV according to a third-party tracker.
Our recommendation
- Inventory all ASUSTOR NAS devices and their ADM versions.
- Remove internet exposure of the ADM web interface now; use VPN or allow-listing.
- Upgrade to ADM 5.1.4.RM62 or 4.3.3.RY62, after checking the no-downgrade note.
- For devices that were internet-exposed while unpatched, review logs and shared files and rotate stored credentials.
- Also check ADM patch levels for CVE-2026-6644, a separate command injection in the PPTP VPN client.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASUSTOR Security Advisory AS-2026-022 www.asustor.com
- ASUSTOR Release Notes www.asustor.com
- ionix.io threat center: CVE-2026-105324 www.ionix.io
- VulDB: CVE-2026-105324 vuldb.com
- OpenCVE: CVE-2026-105324 app.opencve.io
- Strix: CVE-2026-105324 www.strix.ai
- SecurityOnline: ASUSTOR ADM vulnerability CVE-2026-105324 securityonline.info
- CCB Belgium advisory on ASUSTOR ADM ccb.belgium.be
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:51.
Original description (NVD)
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.