Design/Logic Flaw

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

CVE-2018-11344

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

CVE-2018-11341

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

Unrestricted file upload

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

Path traversal

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

CVE-2018-11340

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed...

CVE-2018-11344

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

CVE-2018-11346

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

CVE-2018-11346

CVE-2018-11346 affects ASUSTOR NAS model AS6202T running ADM 3.1.0.RFQ3. The vulnerability is an insecure direct object reference in download.cgi that can reference the action "download_sys_settings" and then specify arbitrary files across the system via the act parameter. The provided documents ...

CVE-2018-11342

CVE-2018-11342 describes a path traversal flaw in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically in the fileExplorer.cgi component. An attacker can exploit the dest_folder parameter to specify arbitrary file system paths and create folders, potentially impacting confidentiality and integrity of the...

CVE-2018-11342

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

CVE-2018-11345

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

CVE-2018-11345

ASUSTOR AS6202T ADM 3.1.0.RFQ3 is affected by CVE-2018-11345: an unrestricted file upload vulnerability in upload.cgi that allows uploading data via the POST parameter filename and, due to path traversal in that parameter, placing files anywhere on the filesystem. This can enable attacker-control...

CVE-2018-11344

CVE-2018-11344 concerns ASUSTOR ADM 3.1.0.RFQ3 on AS6202T. A path traversal vulnerability in download.cgi via the file1 parameter allows an attacker to download arbitrary files from the system. Affected component: download.cgi; root cause: improper validation of file paths in file1. Proof of impa...

CVE-2018-11340

CVE-2018-11340 concerns an unrestricted file upload in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically the importuser.cgi endpoint. The underlying issue is that the program accepts an uploaded file and saves it with a user-supplied filename, enabling an attacker to place attacker-controlled code on ...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. An arbitrary file upload vulnerability exists in the importuser.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3, which stems from the program's failure to validate file extensions. An attacker can...

ASUSTOR ADM has multiple vulnerabilities

ASUSTOR Data Master ADM is an operating system exclusively on ASUSTOR NAS. ASUSTOR ADM suffers from a directory traversal vulnerability, an arbitrary file upload, and a stored XSS vulnerability that can be exploited by attackers to obtain sensitive information, upload files, and perform cross-sit...

How to Reset nsroot Password on NetScaler Console

Citrix ADM, formerly NetScaler Console This article describes how to reset nsroot password on NetScaler MAS. Note: For NetScaler Console Agents, you can replace the path with dev/da0s1a /flash 1. mount dev/da0s1a /flash 2. No /etc/passwd...

GEO Mapping Issues on NetScaler MAS

GEO mapping issues on Citrix ADM...

ADC Upgrade from ADM Fails Due to Insufficient Free Disk Space on ADC Node

The following symptoms are indicative of this issue: ADM command log status shows status as failed along with a message saying"Command failed Rebooting not found in command output" ADM log file /var/log/ns.log shows the message"Command failed Rebooting not found in command output" Dec 13 11:24:39...