Vulnerability · Published Jul 9, 2025 · Assigned by ASUSTOR1

CVE-2025-7378An improper input validation vulnerability was found on manipulating configuration of ADM

Medium 6.0

In plain English

A medium-severity improper input validation in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.1%top 95.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibit unexpected behavior. This issue affects ADM: from 4.1 before 4.3.1.R5A1.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1 – before 4.3.1.R5A1

Weakness: CWE-20 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/R:U/U:Amber

References

https://www.asustor.com/security/security_advisory_detail?id=41 vendor-advisory