A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected backup component. Affected products and versions include:

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products and versions incl

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory information or cause denial of service of the affected component. Affected products and versions inclu

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products

CVE-2026-67244 是一个存在于 ADM (Asustor Data Master) 系统通知 OAuth 设置中的格式化字符串漏洞。漏洞源于用户可控的通知配置输入在通过不安全的格式化字符串操作处理时，可能导致内存信息泄露或拒绝服务。受影响的版本包括 ADM 4.1.0 至 4.3.3.RUN1，以及 ADM 5.0.0 至 5.1.3.RI81。攻击者需要经过身份验证的管理员权限才能利用此漏洞，其后果可能暴露敏感内存数据或导致组件不可用。目前尚未发现该漏洞被广泛利用或在野攻击的证据。建议用户立即升级至最新修复版本，并限制管理界面的网络暴露范围，仅允许受信任 IP 访问。

CVE-2026-18188 是一个影响 ADM 中 Rsync Backup 组件的格式字符串漏洞。该漏洞源于 Rsync 备份配置或日志数据在处理时未安全使用格式化字符串操作，导致用户可控数据被传入不安全的格式化函数。攻击者需经过身份认证，可通过精心构造的输入触发该漏洞，实现内存信息泄露或导致备份组件拒绝服务。受影响的版本包括 ADM 4.1.0 至 ADM 4.3.3.RUN1，以及 ADM 5.0.0 至 ADM 5.1.3.RI81。目前该漏洞尚未被列入已知利用漏洞目录（KEV），也未被标记为在野利用。考虑到 ADM 设备通常用于网络附加存储（NAS），企业环境中部署广泛，一旦被利用可能导致敏感信息泄露或备份服务不可用，影响数据可靠性。建议用户立即检查 ADM 版本，若在受影响范围内，应优先升级至官方提供的最新修补版本，同时在网络中限制 Rsync Backup 端口的暴露范围，仅允许受信任的管理员 IP 访问，并启用多因素认证以降低认证凭据被攻破的风险。

CVE-2026-18187 是 ASUSTOR 数据管理 (ADM) 系统中 Internal Backup 组件的一个格式字符串漏洞。该漏洞源于用户可控的任务输入可能被包含在错误响应中，并经过不安全的格式字符串操作处理。攻击者需要先通过身份验证，随后可构造特制的任务输入触发该漏洞，导致内存信息泄露或造成受影响的 CGI 进程拒绝服务。受影响的产品版本包括 ADM 4.1.0 至 4.3.3.RUN1，以及 ADM 5.0.0 至 5.1.3.RI81。目前该漏洞尚未被列入已知被利用漏洞清单 (KEV)，也未见在野利用报告。由于需要身份验证，漏洞利用门槛相对较高，但仍可能被用于内部提权或破坏系统稳定性。建议用户尽快升级到最新版本，同时限制对 ADM 管理界面的网络暴露，仅允许可信 IP 访问。

CVE-2026-18186 是 ADM (Asustor Data Master) 系统中 FTP 备份功能存在的一个存储型格式字符串漏洞。该漏洞源于用户可控的备份配置数据被写入任务日志，随后在未安全处理格式字符串的情况下被解析。攻击者可以利用该漏洞，通过精心构造的备份配置，在日志中插入格式化字符串占位符，当 CGI 进程处理日志时，这些占位符会被执行，导致内存信息泄露或触发拒绝服务。受影响的 ADM 版本包括 4.1.0 至 4.3.3.RUN1 以及 5.0.0 至 5.1.3.RI81。该漏洞需要攻击者拥有有效账户，已认证的攻击者可通过 FTP 备份功能进行利用。目前尚无公开的利用代码或证据表明存在在野利用。建议用户尽快关注官方安全公告，安装补丁更新，并在无法立即修补时限制受影响系统的网络暴露，仅允许可信 IP 访问管理界面。

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. Th

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. Th

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information dis

An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this vulnerability by sending crafted login data, potentially causing information disclosure, memory corrupti

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintende

Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privileges.

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions,

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions,

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in Do

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification servi

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification servi

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in Do

A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input that triggers incorrect format string processing.

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service.

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leadin

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leadin

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.