ASUSTOR NAS Interfaces: 548 Title Matches Against 13 Application Matches

ASUSTOR NAS devices are vulnerable to an unauthenticated HTTP header injection exploit, CVE-2026-105324. This flaw allows attackers to perform an arbitrary file read through the web server. The impact is significant, as ASUSTOR NAS devices are often placed on the open internet, making the exposure a practical issue rather than merely theoretical.

The vulnerability was discovered in the ASUSTOR ADM software, which carries the flaw. According to measurements taken on October 9, 2026, between 02:50 and 02:52 UTC, there are 548 instances of the product name "ASUSTOR" matching titles, compared to only 13 instances matching the application. This discrepancy suggests that the title query is a subset of the application query.

The vulnerability is concerning because storage appliances can reveal sensitive information, including configuration stores and credential material. The flaw does not require authentication, making it possible for anyone who can reach the interface to exploit it. Remote access to the management interface is typically enabled by default and often left unchanged, increasing the risk of exploitation.

To address the vulnerability, users should update to either ADM 5.1.4.RM62 or 4.3.3.RY62. If an update is pending, it is recommended to remove remote access to the management interface until the update can be applied. For appliances that are internet-facing, it is essential to review which files could have been read and rotate the credentials containing that information.

The vulnerability has been fixed in the latest versions of the ASUSTOR ADM software. For more information, refer to the ZoomEye search and the ASUSTOR security online report.