Format String Vulnerability in Rsync Backup on Asustor ADM
CVE-2026-18188

7.1HIGH

Key Information:

Vendor

Asustor Inc.

Status
Adm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-18188?

A format string vulnerability has been identified in the Rsync Backup component of Asustor's ADM. This vulnerability stems from the potential misuse of user-controlled rsync backup configuration or log data, which can be processed through an unsafe format string operation. When exploited by an authenticated attacker, this flaw may lead to the disclosure of sensitive memory information or result in a denial of service for the affected backup component. Organizations using vulnerable versions should take immediate steps to mitigate risks.

Affected Version(s)

ADM Linux 5.0.0 <= 5.1.3.RI81

ADM Linux 4.1.0 <= 4.3.3.RUN1

References

https://www.asustor.com/security/security_advisory_detail...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.