CVE-2026-24936Disclosure(asustor / data_master)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch asustor data_master systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

asustor CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.asustor.com/security/security_advisory_detail?id=51

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

data_master

Threat summary

Patch or workaround signal is available
9 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 9 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 3d ago at 4 mentions (2026-02-03); latest day: 1
9 total mentions across 4 days

Affected systems

Vendors

asustor

Products

data_master

Deep dive

Activity timeline9 mentions / 4d

Signal classification3 categories

Disclosure

555.6%

Patch

333.3%

General

111.1%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-03	4	Disclosure4
2026-02-04	3	General1Patch2
2026-02-12	1	Patch1
2026-03-12	1	Disclosure1

Full discourse9 posts

Hunter@HunterMapping246d
Patch
🚨Alert🚨 CVE-2026-24936 (CVSS 9.5): Critical ASUSTOR Flaw Allows Remote System Takeover 📊 415K Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22ASUSTOR%20ADM%22 👇Query HUNTER : http://product.name="ASUSTOR ADM" 📰Refer:https://www.asustor.com/security/security_advisory_detail?id=51 https://securityonline.info/cve-2026-24936-critical-asustor-flaw-cvss-9-5-allows-remote-system-takeover/ #hunterhow #infosec #infosecurity #OSINT #Vulnerability
Post summary
The post announces CVE‑2026‑24936 with a CVSS score of 9.5, describing a remote takeover flaw in ASUSTOR ADM, and points to a vendor advisory that implies patch availability.
014044183.9K
25.4K followersView on X
CCB Alert@CCBalert247d
Disclosure
Warning: Critical file-overwrite flaw in ASUSTOR ADM (CVE-2026-24936, CVSS 9.5). Unauthenticated attackers can exploit improper input validation in AD join functionality to write arbitrary files and potentially take over the device. https://ccb.belgium.be/advisories/warning-critical-file-overwrite-asustor-adm-unauthenticated-attackers-can-compromise-nas #Patch #Patch #Patch
Post summary
A critical file‑overwrite vulnerability (CVE‑2026‑24936) in ASUSTOR ADM permits unauthenticated attackers to write arbitrary files and potentially seize control; patching is advised.
02010296
7.2K followersView on X
kokumօtօ@__kokumoto247d
Patch
ASUSTOR ADM (ASUSTOR Data Master)に重大(Critical)な脆弱性。CVE-2026-24936はCVSSスコア9.5で、AD接続機能における入力検証の不備により、未認証の攻撃者による任意ファイル書き込みが成立。修正版提供あり。 https://securityonline.info/cve-2026-24936-critical-asustor-flaw-cvss-9-5-allows-remote-system-takeover/
Post summary
CVE‑2026‑24936 is a critical vulnerability in ASUSTOR ADM that permits unauthenticated file writes; the vendor has released a patch to remediate the flaw.
00020715
7.2K followersView on X
CVE@CVEnew248d
Disclosure
CVE-2026-24936 When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an un… https://www.cve.org/CVERecord?id=CVE-2026-24936
Post summary
A new improper input validation vulnerability (CVE‑2026‑24936) in a CGI program used when joining an AD Domain via ADM is disclosed. No PoC, exploit, or patch information is included.
00011316
56.5K followersView on X
Komodo Cyber Security@Komodosec210d
Disclosure
#VulnerabilityReport #activedirectory CVE-2026-24936: Critical ASUSTOR Flaw (CVSS 9.5) Allows Remote System Takeover https://securityonline.info/cve-2026-24936-critical-asustor-flaw-cvss-9-5-allows-remote-system-takeover/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet reports the identification of a new high‑severity vulnerability (CVE-2026-24936) that permits remote system takeover, but it does not provide PoC, exploitation evidence, or patch details.
0001052
1.5K followersView on X
iototsecnews@iototsecnews239d
Patch
ASUSTOR NAS の脆弱性 CVE-2026-24936 が FIX：デバイスの乗っ取りの恐れ https://iototsecnews.jp/2026/02/04/critical-asustor-nas-security-flaw-enables-complete-device-takeover/ ASUSTOR 製 NAS の OS (ADM) において、Active Directoryドメインに参加する際の処理プログラムに、入力データのチェック漏れが発見されました。具体的には、外部から送られてくる情報を正しく検証せずに受け入れてしまい、未認証のリモート攻撃者に対して、システム内の重要なファイルの書き換えを許してしまいます。それにより、攻撃者は NAS の管理者権限 (root) を奪取し、保存されている機密データやシステムの設定を完全に掌握することが可能になります。特に、特定の機能が有効化されている場合にリスクが高まるため、対象となる ADM 5.x 系を利用している場合は、速やかな修正が必要です。 #ASUSTOR #CVE202624936 #NAS #Vulnerability
Post summary
ASUSTOR NAS CVE-2026-24936 enables unauthenticated remote attackers to overwrite critical files and take full root control; the article stresses the urgent need for a vendor patch but offers no exploit code or evidence of active exploitation.
01000105
483 followersView on X
Karma-X@Karma_X_Inc246d
General
CVE-2026-24936: Critical ASUSTOR Flaw (CVSS 9.5) Allows Remote System Takeover https://securityonline.info/cve-2026-24936-critical-asustor-flaw-cvss-9-5-allows-remote-system-takeover/
Post summary
The statement announces CVE‑2026‑24936 as a critical flaw in ASUSTOR devices with a CVSS score of 9.5 that permits remote system takeover, but it offers no evidence of active exploitation, PoC, or remediation.
0000059
73 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds248d
Disclosure
CVE-2026-24936 Unauthenticated File Write Vulnerability in ADM Domain Join Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24936
Post summary
A new unauthenticated file write vulnerability (CVE‑2026‑24936) in the ADM Domain Join Function has been disclosed, but no exploitation, patch, or PoC details are provided.
0000078
4.0K followersView on X
0day Signal@0dayPublishing248d
Disclosure
🚨 CVE-2026-24936: An improper input validation vul... Unauthenticated remote arbitrary file write in ASUSTOR ADM's domain join function grants full system takeover with zero... https://zerodaysignal.com/vulnerability/CVE-2026-24936 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2026‑24936, describing an unauthenticated arbitrary file write vulnerability in ASUSTOR ADM’s domain join function that permits full system takeover, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
00000113
132 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	asustor	data_master	-	-	-

Explore more

Back to dashboard asustor CVEs data_master vulnerabilities

What researchers are saying

CVE-2026-24936

Hunter[verified]@HunterMappingPatch

The post announces CVE‑2026‑24936 with a CVSS score of 9.5, describing a remote takeover flaw in ASUSTOR ADM, and points to a vendor advisory that implies patch availability.

kokumօtօ[verified]@__kokumotoPatch

CVE‑2026‑24936 is a critical vulnerability in ASUSTOR ADM that permits unauthenticated file writes; the vendor has released a patch to remediate the flaw.

Komodo Cyber Security[verified]@KomodosecDisclosure

The tweet reports the identification of a new high‑severity vulnerability (CVE-2026-24936) that permits remote system takeover, but it does not provide PoC, exploitation evidence, or patch details.

Karma-X[verified]@Karma_X_IncGeneral

The statement announces CVE‑2026‑24936 as a critical flaw in ASUSTOR devices with a CVSS score of 9.5 that permits remote system takeover, but it offers no evidence of active exploitation, PoC, or remediation.

CCB Alert@CCBalertDisclosure

A critical file‑overwrite vulnerability (CVE‑2026‑24936) in ASUSTOR ADM permits unauthenticated attackers to write arbitrary files and potentially seize control; patching is advised.

CVE@CVEnewDisclosure

A new improper input validation vulnerability (CVE‑2026‑24936) in a CGI program used when joining an AD Domain via ADM is disclosed. No PoC, exploit, or patch information is included.

iototsecnews@iototsecnewsPatch

ASUSTOR NAS CVE-2026-24936 enables unauthenticated remote attackers to overwrite critical files and take full root control; the article stresses the urgent need for a vendor patch but offers no exploit code or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new unauthenticated file write vulnerability (CVE‑2026‑24936) in the ADM Domain Join Function has been disclosed, but no exploitation, patch, or PoC details are provided.