CVE-2026-67248
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the File Explorer on ADM. User-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer, potentially causing denial of service of the CGI process.
Risk Assessment
An authenticated attacker can cause denial of service, and further impact may be possible depending on runtime protections.
Recommendation
Update ADM to a version outside the vulnerable range (above 4.3.3.RUN1 or 5.1.3.RI81). Restrict access to File Explorer to trusted users only.
Other vulnerabilities in ADM
See all- CVE-2026-67247Medium
A path traversal vulnerability was found in the IHM Log handling of ADM. User-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file.
- CVE-2026-67246Medium
A path traversal vulnerability in the Wallpaper component of ADM. User-controlled wallpaper path input is not sufficiently validated, allowing access to files outside the intended wallpaper directory.
- CVE-2026-67245High
A path traversal vulnerability was found in the VPN Clients on ADM. User-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path.
- CVE-2026-67244High
A format string vulnerability was found in the Notification OAuth settings of ADM. User-controlled notification configuration input may be processed through an unsafe format string operation.
- CVE-2026-18188High
A format string vulnerability was found in the Rsync Backup on ADM. User-controlled rsync backup configuration or log data may be processed through an unsafe format string operation.
- CVE-2026-18187High
A format string vulnerability in the Internal Backup function of ADM. User-controlled task input is processed unsafely, allowing memory information disclosure or denial of service.
- CVE-2026-18186High
A stored format string vulnerability in the FTP Backup function of ADM. User-controlled backup configuration data is logged and later processed unsafely, allowing memory disclosure or denial of service.
Original NVD description (English source)
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial of service of the affected CGI process. Further impact may be possible depending on exploitability and runtime protections. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.