CVE-2025-7378: An improper input validation vulnerability was found on manipulating configuration of ADM

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-09 · updated 2026-06-17
Weakness: CWE-20

Description

An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibit unexpected behavior. This issue affects ADM: from 4.1 before 4.3.1.R5A1.

Affected products

ASUSTOR ADM: from 4.1 before 4.3.1.R5A1 — fixed in 4.3.1.R5A1

How to fix

Upgrade to a fixed version: ASUSTOR ADM 4.3.1.R5A1. Check the vendor advisory for mitigations.

References

https://www.asustor.com/security/security_advisory_detail?id=41

Get alerted when CVE-2025-7378 or the next vulnerability affects your stack