ASUSTOR ADM < 3.1.6 Multiple Vulnerabilities

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

ADM 3.1.2RHG1 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Title: Asustor ADM 3.1.2RHG1 - Remote Code Execution Author: Matthew Fulton & Kyle Lovett Vendor Homepage: https://www.asustor.com/ Software Link: http://download.asustor.com/download/adm/X64G33.1.2.RHG1.img Version: = ADM 3.1.2RHG1 Teste...

ADM 3.1.2RHG1 Remote Code Execution

Title: Asustor ADM 3.1.2RHG1 - Remote Code Execution Author: Matthew Fulton & Kyle Lovett Date: 2018-07-01 Vendor Homepage: https://www.asustor.com/ Software Link: http://download.asustor.com/download/adm/X64G33.1.2.RHG1.img Version: = ADM 3.1.2RHG1 Tested on: ASUSTOR AS6202T CVE : CVE-2018-11510...

ASUSTOR ADM SQL Injection Vulnerability

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. photo gallery is one of the photo management applications. An SQL injection vulnerability exists in the 'albumid' and 'scope' parameters of the tree list function of the photo gallery application in ASUSTOR...

CVE-2018-11509: Use of Hard-coded Credentials

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell...

CVE-2018-11511

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the ‘albumid’ or ‘scope’ parameter via a photo-gallery/api/album/treelists/ URI. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed...

CVE-2018-11511: Improper Neutralization of Special Elements used in an SQL Command

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...

PT-2018-10625

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.0.RFQ3 Description The issue allows an attacker to login using the default root:admin username and password, which is the same as the one used for the NAS itself for applications installed from the online repository. Th...

CVE-2018-11510

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecatejs.cgi file by embedding OS commands in the 'script' parameter...

CVE-2018-11510: Improper Neutralization of Special Elements used in an OS Command

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecatejs.cgi file by embedding OS commands in the 'script' parameter...

PT-2018-10627

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.0.RFQ3 Description The issue is related to an unauthenticated remote code execution in the "portal/apis/aggrecate js.cgi" API endpoint. This is achieved by embedding OS commands in the script parameter. Recommendations...

Asustor ADM Command Injection (CVE-2018-11510)

A remote command injection vulnerability exists in Asustor ADM. Successful exploitation would allow an attacker to execute arbitrary code on the target machine...

ASUSTOR ADM has multiple vulnerabilities

ASUSTOR Data Master ADM is an operating system exclusively on ASUSTOR NAS. ASUSTOR ADM suffers from a directory traversal vulnerability, an arbitrary file upload, and a stored XSS vulnerability that can be exploited by attackers to obtain sensitive information, upload files, and perform cross-sit...