CVE-2018-12312

ASUSTOR ADM 3.1.1 contains an OS command injection in user.cgi that allows an attacker to run commands as root via the secret_key URL parameter. Vulnerability is triggered through network exposure to ASUSTOR ADM's web interface, enabling arbitrary command execution with root privileges if the par...

CVE-2018-12311

ASUSTOR ADM File Explorer (v3.1.1) is affected by a cross-site scripting vulnerability. When a file is moved using a malicious filename, an attacker can cause arbitrary JavaScript execution. The reports do not provide specific fixes or patch versions in the supplied documents.

CVE-2018-12313

CVE-2018-12313 affects ASUSTOR ADM 3.1.1: OS command injection in snmp.cgi exploitable without authentication via the rocommunity parameter. Impact: remote code execution with high integrity/availability risk (CVSSv3/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8). Affected component: snmp.cgi in ADM;...

CVE-2018-12309

CVE-2018-12309 describes a directory traversal in ASUSTOR ADM 3.1.1, via upload.cgi, allowing an attacker to upload files to arbitrary locations by modifying the path URL parameter (the filename parameter is covered by CVE-2018-11345). NVD lists CVSS v3.0 base score 7.5 (HIGH) with network attack...

CVE-2018-12319

CVE-2018-12319 affects ASUSTOR ADM 3.1.1. The Available connected documents describe a Denial-of-Service on the login page caused by placing malformed text in the login page title, preventing users from signing in. The vulnerability impact is partial availability loss (DoS) with a high CVSS 3.0 b...

CVE-2018-12316

ASUSTOR ADM is affected by OS Command Injection in upload.cgi in version 3.1.1, where an attacker can modify the filename POST parameter to execute system commands. This is documented across multiple sources (NVD CVE-2018-12316, CNVD-2018-25181, OpenVAS entry) with a CVSS base score high (3.0: 8....

CVE-2018-12318

CVE-2018-12318 relates to ASUSTOR ADM (versions including 3.1.1) where the SNMP settings page leaks the SNMP password in plaintext. The CVE is documented in multiple sources (NVD and CNVD entries) with the same basic impact: information disclosure. The root cause is an information disclosure flaw...

CVE-2018-12309

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

CVE-2018-12310

CVE-2018-12310 describes a cross-site scripting vulnerability in ASUSTOR ADM (login page, version 3.1.1) where an attacker can inject JavaScript through the System Announcement feature. Affected component: ASUSTOR ADM login flow. Underlying issue: stored/reflected XSS in the login surface (detail...

CVE-2018-12314

ASUSTOR ADM 3.1.1 is affected by a directory traversal vulnerability in downloadwallpaper.cgi. The issue allows an attacker to download arbitrary files by manipulating the file and folder URL parameters. This is documented in CVE-2018-12314 (NVD entry) and corroborated by CNVD-2018-25182, which d...

PT-2018-11112

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands without authentication. This is achieved via the rocommunity URL parameter in the snmp.cgi module. Recommendations For ASUSTOR ADM version 3.1.1,...

CVE-2018-12308: Exposure of Sensitive Information to an Unauthorized Actor

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...

PT-2018-11106

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to obtain the encryption key via the encrypt key variable in the share.cgi API endpoint. Recommendations For ASUSTOR ADM version 3.1.1, avoid using the encrypt key variable in th...

PT-2018-11109

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue concerns cross-site scripting in the Login page, specifically via the System Announcement feature, allowing attackers to execute JavaScript. Recommendations For ASUSTOR ADM version 3.1.1, conside...

PT-2018-11104

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description A directory traversal issue in the File Explorer component allows attackers to view arbitrary files by modifying the file1 URL parameter. This issue is similar to a previously known problem. Recommendation...

PT-2018-11111

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root via the secret key URL parameter in the user.cgi module. Recommendations For ASUSTOR ADM version 3.1.1, avoid using the secret key parameter in...

PT-2018-11105

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root via the name POST parameter in the user.cgi module. This can be exploited by sending a malicious POST request to the vulnerable endpoint...

PT-2018-11117

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to obtain the SNMP password in cleartext due to information disclosure in the SNMP settings page. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting access to th...

PT-2018-11114

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue concerns a missing verification of a password, allowing attackers to change account passwords without entering the current password. Recommendations For ASUSTOR ADM version 3.1.1, update to a...

PT-2018-11113

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to download arbitrary files by manipulating the file and folder URL parameters in the downloadwallpaper.cgi. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting...