CVE-2026-18186 in ADM
Summary
by MITRE • 07/30/2026
A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical stored format string flaw in the FTP backup functionality of the ADM system, classified under CWE-134 which specifically addresses the use of untrusted data in format string contexts. The vulnerability stems from improper input validation and sanitization of user-controlled backup configuration parameters that are subsequently written to task logs without adequate escaping or encoding. When these logged entries are later processed through unsafe format string operations such as printf or sprintf functions, the attacker-controlled data can be interpreted as format specifiers rather than literal text, creating a dangerous attack vector that violates fundamental security principles of input sanitization and output encoding.
The technical exploitation mechanism leverages authenticated access to manipulate backup configuration settings that get stored in system logs, where the format string vulnerability manifests when these stored entries are processed during subsequent log parsing or display operations. This creates a persistent threat where an attacker with valid credentials can inject malicious format specifiers into backup configurations, which then get executed during log processing operations that lack proper validation of input data. The attack can result in information disclosure through memory corruption techniques such as %x or %s format specifiers that read from stack memory locations, potentially exposing sensitive system information including administrative credentials, system paths, or other confidential data structures that could be leveraged for further exploitation.
The operational impact of this vulnerability extends beyond simple denial of service to encompass potential complete system compromise through information disclosure and execution of arbitrary code. When the affected CGI process handles these malformed format strings during log processing, it can lead to segmentation faults, memory corruption, or even remote code execution depending on the specific implementation details and memory layout. The vulnerability affects multiple product versions spanning from ADM 4.1.0 through 4.3.3.RUN1 and from ADM 5.0.0 through 5.1.3.RI81, indicating a widespread issue that requires comprehensive remediation across various system deployments. This vulnerability maps to attack techniques in the MITRE ATT&CK framework under T1059 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation, as it allows authenticated attackers to escalate privileges through memory disclosure attacks.
The recommended mitigation strategies include implementing strict input validation and sanitization of all user-controlled backup configuration parameters before storage, employing proper format string handling techniques such as using printf with explicit format specifiers instead of user-controlled strings, and implementing comprehensive log parsing routines that properly escape or encode stored data. Organizations should also consider implementing input/output encoding standards such as those specified in the OWASP Input Validation Cheat Sheet and apply the principle of least privilege to limit the scope of authenticated access that can manipulate backup configurations. Additionally, regular security auditing of log processing functions and format string usage patterns should be conducted to identify similar vulnerabilities across the system, while also considering automated patch management and version control to ensure all affected systems are updated to patched versions that address this stored format string vulnerability through proper code review and secure coding practices.