ASUSTOR NAS Interfaces: 548 Title Matches Against 13 Application Matches

ASUSTOR ADM carries CVE-2026-105324, an unauthenticated HTTP header injection rated 9.2 that reaches an arbitrary file read through the web server. NAS devices are commonly placed on the open internet, which makes the exposure question a practical one rather than a theoretical one. The two query styles disagree by a wide margin here.

The measurements

ZoomEye queries executed on 2026-10-09 between 02:50 and 02:52 UTC, sub_type all, global index:
| Query | Matching assets |
| --- | ---: |
| title="ASUSTOR" | 548 |
| app="ASUSTOR" | 13 |
The title query returns 548 matches and the application query returns 13. The difference is large enough that the stricter fingerprint should be read as a subset rather than as the population. Sub-branded model pages and customised login banners explain part of the gap.

Why storage deserves its own review

A file read on a storage appliance returns whatever the appliance can read, which includes configuration stores and credential material. The flaw needs no authentication, so the deciding factor is who can reach the interface. Remote access is a convenience feature on these devices and it is frequently enabled once and then left alone.

What to do

Update to ADM 5.1.4.RM62 or 4.3.3.RY62, and while the update is pending remove remote access to the management interface. Where the appliance was internet-facing, review which files could have been read and rotate the credentials they contained.

Method notes and limits

Counts are fingerprint matches without version detail, and a reachable appliance is not proof of a vulnerable build. Both queries used the same scope setting in the same session.

References

ZoomEye, cyberspace search: https://www.zoomeye.ai
ASUSTOR fixes critical ADM flaw CVE-2026-105324: https://securityonline.info/asustor-adm-vulnerability-cve-2026-105324/