CVE-2026-24936 is a critical flaw (CVSS 9.8) in ASUSTOR's ADM operating system for its NAS devices. When a specific function is enabled while joining an Active Directory domain, a CGI program fails to validate input and lets an unauthenticated remote attacker write data to any file. ASUSTOR has released ADM 5.1.2.RE51 and 4.3.3.RR42.
What's affected
- Affected: ADM 4.1.0 through 4.3.3.ROF1, and ADM 5.0.0 through 5.1.1.RCI1.
- Fixed in: ADM 5.1.2.RE51 (released 5 February 2026) and ADM 4.3.3.RR42 (released 5 March 2026), according to the ASUSTOR advisory AS-2026-002.
The advisory's revision history shows the initial public release on 26 January 2026, a CVE assigned on 3 February 2026, and the two fixed builds later.
How to check if you're exposed
Open ADM and check the version on the settings or the About screen. Compare it with the ranges above. Then check whether the NAS is joined to an Active Directory domain, because the description ties the flaw to the domain join function being enabled.
Also check whether the NAS web interface is reachable from the internet. A NAS that sits behind a firewall with no port forwarding is much harder to reach than one that is published.
What to do now
- Update ADM to 5.1.2.RE51 or later on the 5.x line, or 4.3.3.RR42 or later on the 4.x line.
- Check the ASUSTOR advisory for the exact build that matches your model.
- Remove any port forwarding to the NAS management interface.
- Back up important data to a separate location before and after the update.
- If the NAS was exposed before you patched, review it for unexpected changes, and consider a clean restore from a known good state.
Why it matters
The record classes the weakness as CWE-20 (Improper Input Validation). A CGI program accepted parameters it should have checked, and the result is that an attacker can choose which file is written. Overwriting critical system files, as the advisory says, can lead to complete takeover of the device.
NAS devices hold backups and shared files, which makes them valuable targets. They also tend to be set up once and forgotten. Put NAS firmware on the same patch calendar as servers.
Quick check
Do I need to be on an Active Directory domain to be affected?
The description says the issue arises when a specific function is enabled while joining an AD domain from ADM. If you do not use domain join, your exposure is narrower, but update anyway.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the ASUSTOR advisory I read does not report exploitation.
Sources
Last reviewed: 19 October 2026.
