Horizon Alert
Summary of the vulnerability and why it matters
A command injection vulnerability in ASUSTOR Data Master allows an authenticated administrator to execute arbitrary code on the system. This happens because the system does not properly check user-provided input before sending it to system commands, potentially leading to a full compromise.
- Allows code execution.
- Affects administrative users.
- Requires administrative access.
Attack Path
How an attacker could exploit the issue
An authenticated administrator could exploit this by submitting crafted input to the PPTP VPN client. This input would bypass security checks, allowing for code execution on the underlying operating system.
- Requires administrative access.
- Targets PPTP VPN client input.
- Unrestricted command execution.
Live Threat
Current exploitation, exposure, and threat context
Attackers may be interested in this command injection vulnerability, as it allows for remote code execution. However, the requirement for administrative privileges significantly limits its broad appeal. Exploitation is less likely if the affected management interface is not exposed externally, which is a common security practice.
- Exploitation requires admin credentials.
- No public exploit code observed.
- Limited public discussion.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of ADM versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1, as this command injection vulnerability allows for full system compromise via RCE. If patching is delayed, investigate all administrative user accounts for suspicious activity and segment affected devices from critical internal networks.
- Patch to resolved versions.
- Restrict administrative access.
- Monitor logs for unauthorized commands.
