ASUSTOR patches 9.2-rated ADM header injection as ZoomEye shows hundreds of exposed NAS interfaces

ASUSTOR ships ADM fixes for critical header injection

ASUSTOR has released patches for CVE-2026-105324, an unauthenticated HTTP header injection in its ADM operating system that carries a severity score of 9.2 and can be leveraged for arbitrary file read through the appliance's web server. According to a dev.to analysis of the flaw, the vulnerability requires no credentials, so the practical question is not whether an attacker can exploit it but whether they can reach the interface at all.

The fix arrives as ADM 5.1.4.RM62 for current-generation devices and ADM 4.3.3.RY62 for those on the older branch, the analysis notes, pointing to Security Online's coverage of the patch. Neither source reports active exploitation so far.

Hundreds of interfaces reachable on the open internet

To gauge how many devices could be in the blast radius, the dev.to post queried ZoomEye, a search engine for internet-connected assets, on 9 October between 02:50 and 02:52 UTC. Two fingerprint styles returned very different pictures. A title-based query for pages containing "ASUSTOR" matched 548 assets, while an application fingerprint query matched just 13.

The author's reading is that the stricter application fingerprint should be treated as a subset of the true population rather than the population itself. Sub-branded model pages and customised login banners can defeat an application fingerprint while still naming the vendor in the page title, which would account for much of the gap. Both queries ran with identical scope settings in the same session, the post notes.

The measurement has clear limits. The counts are fingerprint matches without version detail, and a reachable appliance is not proof of a vulnerable build — hardware already running patched firmware would not be affected even where its banner still matches.

Why a file read on a NAS is worse than it sounds

The dev.to analysis argues that arbitrary file read on a storage appliance is a different class of problem from the same flaw on an ordinary web application. An attacker can pull any file the device itself can access, which on a NAS includes configuration stores and credential material alongside backup sets and shared documents holding service accounts and other secrets.

Deployment habits compound the risk. Remote access to the management interface is a convenience feature on these devices, and the post observes that it is often switched on at setup and never revisited. Combined with a flaw that skips authentication entirely, that habit turns what would be a LAN-internal bug into an internet-facing one.

What operators should do now

The recommended sequence from the analysis is straightforward. Update to ADM 5.1.4.RM62 or 4.3.3.RY62, and until the patch lands, cut off remote access to the management interface so the vulnerable endpoint is not reachable from outside.

For appliances that were already internet-facing, the post advises working out which files were readable through the flaw and changing any credentials stored in them. That second step matters because patching closes the door but does nothing about material an attacker may already have taken.

Why it matters

Two things make this story worth attention beyond ASUSTOR owners. First, the vulnerability needs no authentication and rates 9.2, which means exposure — not attacker capability — is the only real barrier to exploitation. Second, the gulf between 548 and 13 matches is a useful reminder that asset-discovery numbers depend heavily on fingerprint method. A single strict query can understate an exposed population by an order of magnitude, so anyone using scans like these to find forgotten appliances inside their own estate should treat broad and narrow fingerprints as complements rather than alternatives.