title: A stack-based buffer overflow vulnerability was found in the ADM
description: A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and below as well as 4.2.0.RE71 and below.
problem types: CWE-787 Out-of-bounds Write
affected:
{
defaultStatus: unaffected
platforms: [Linux, x86, 64 bit, ARM]
product: ADM
vendor: ASUSTOR
versions:
lessThanOrEqual: 4.0.6.REG2, status: affected, version: 4.0, versionType: custom
lessThanOrEqual: 4.1.0.RLQ1, status: affected, version: 4.1, versionType: custom
lessThanOrEqual: 4.2.0.RE71, status: affected, version: 4.2, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update ADM to the latest version for fixing the issue.