Vulnerability · Published Aug 5, 2022 · Assigned by ASUSTOR1

CVE-2022-37398A stack-based buffer overflow vulnerability was found on ADM

High 7.1

In plain English

A high-severity stack buffer overflow in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	3.5 – through 3.5.9.RUE34.0 – through 4.0.5.RVI14.1 – through 4.1.0.RJD1

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

References

https://www.asustor.com/security/security_advisory_detail?id=12 x_refsource_MISC