CVE-2026-67245: data master from 4.1.0.rhu2 (inclusive), through 4.3.3.run1 (inclusive), from 5.0.0.ra82 (inclusive), before…

Affected technology

data master · from 4.1.0.rhu2 (inclusive), through 4.3.3.run1 (inclusive)
asustor

data master · from 5.0.0.ra82 (inclusive), before 5.1.4.rjv2 (exclusive)
asustor

ADM · 5.0.0 through 5.1.3.RI81, 4.1.0 through 4.3.3.RUN1
ASUSTOR Inc.

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An authenticated attacker can exploit this issue to write an uploaded certificate file outside the intended VPN certificate directory, subject to process privileges and filesystem permissions. Vendor/CNA’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality impact as none; integrity and availability impact as high.