CVE-2018-11341

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

PT-2018-10503

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to upload files via the filename parameter in the POST request to the "upload.cgi" endpoint. This can lead to the execution of attacker-controlled code on the file...

PT-2018-10498

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to upload supplied data to a specified filename due to an unrestricted file upload vulnerability in importuser.cgi. This can be used to place attacker-controlled cod...

CVE-2018-11346: Direct Request

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

PT-2018-10500

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue in the fileExplorer.cgi component allows attackers to specify arbitrary paths to system files, enabling them to create folders using the dest folder parameter...

CVE-2018-11341: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. An arbitrary file upload vulnerability exists in the importuser.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3, which stems from the program's failure to validate file extensions. An attacker can...

CVE-2018-11342: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

CVE-2018-11345: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

CVE-2018-11340: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed...

PT-2018-10499

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to navigate the file system via the filename parameter in the importuser.cgi. This is a directory traversal issue. Recommendations For ASUSTOR AS6202T ADM version...

PT-2018-10504

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows for an insecure direct object reference, enabling access to arbitrary files throughout the system. This is achieved by referencing the "download sys settings" action and...

PT-2018-10502

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue exists, allowing attackers to specify any file on the system for download using the file1 parameter in the "download.cgi" endpoint. Recommendations For ASUSTOR AS6202T A...

CVE-2018-11344: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...