A high-severity format string vulnerability in ASUSTOR ADM could allow an authenticated administrator to compromise system confidentiality, integrity, and availability.

This is a format string vulnerability (CWE-134) located within the Notification OAuth settings. The vulnerability requires the attacker to have high privileges (authenticated as an administrator) to execute.

The CVSS score of 8.6 reflects a high severity, indicating that successful exploitation results in significant impact to the core security triad. An attacker with administrative access could leverage this flaw to execute arbitrary code, leading to total system compromise, data loss, or unauthorized modification of system configuration.

Immediate Action: Administrators must update ASUSTOR ADM to the latest version provided by the vendor to patch this vulnerability.

Proactive Monitoring: Monitor system logs for unusual activity related to OAuth configuration changes or unexpected process crashes that might indicate exploitation attempts.

Compensating Controls: Restrict access to the administrative interface to trusted management networks only to minimize the risk of unauthorized administrative account access.

Public Exploit Available: Unknown.

Given the severity of a format string vulnerability, organizations should prioritize updating their ASUSTOR ADM instances. Ensure that administrative credentials are robust and that access to management interfaces is strictly controlled until the patch is applied.