This vulnerability (CVE-2026-67245) in ASUSTOR Inc. ADM VPN Clients is due to improper limitation of a pathname to a restricted directory (CWE-22). The issue occurs because the software does not sufficiently validate the certificate name input provided by the user before constructing the upload destination path. An authenticated attacker with high privileges can exploit this flaw to perform path traversal, enabling them to write an uploaded certificate file outside the intended VPN certificate directory, constrained by process privileges and filesystem permissions. Affected versions include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An authenticated attacker with high privileges can exploit this vulnerability to write files outside the designated VPN certificate directory. This may lead to unauthorized file placement on the system, potentially impacting system integrity depending on the privileges of the process and filesystem permissions. The vulnerability does not require user interaction and has a network attack vector, increasing its risk in networked environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the VPN client functionality to trusted users with appropriate privileges and monitor for unusual file system activity related to certificate uploads.