CVE-2026-18186

{
  "id": "CVE-2026-18186",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-30T03:16:24.213",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad de cadena de formato almacenada en la copia de seguridad FTP en el ADM. La vulnerabilidad ocurre porque los datos de configuración de copia de seguridad controlados por el usuario pueden ser escritos en un registro de tareas y posteriormente procesados a través de una operación de cadena de formato insegura. Un atacante autenticado puede explotar este problema para divulgar información de memoria o causar denegación de servicio del proceso CGI afectado.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.RUN1, así como desde ADM 5.0.0 hasta ADM 5.1.3.RI81."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ASUSTOR Inc.",
          "product": "ADM",
          "defaultStatus": "unaffected",
          "packageName": "FTP Backup",
          "platforms": [
            "Linux",
            "x86",
            "ARM",
            "64 bit"
          ],
          "versions": [
            {
              "version": "5.0.0",
              "lessThanOrEqual": "5.1.3.RI81",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.1.0",
              "lessThanOrEqual": "4.3.3.RUN1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-30T13:14:49.041083Z",
          "id": "CVE-2026-18186",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.1.0.rhu2",
              "versionEndIncluding": "4.3.3.run1",
              "matchCriteriaId": "E8B93EE0-5A71-4537-A116-D3A024BFD988"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0.ra82",
              "versionEndExcluding": "5.1.4.rjv2",
              "matchCriteriaId": "1F80E3A8-B1E6-4AD0-95B4-20B47991E8EF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.asustor.com/security/security_advisory_detail?id=67",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}