CVE-2018-11344

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

CVE-2018-11346

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

CVE-2018-11340

CVE-2018-11340 concerns an unrestricted file upload in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically the importuser.cgi endpoint. The underlying issue is that the program accepts an uploaded file and saves it with a user-supplied filename, enabling an attacker to place attacker-controlled code on ...

CVE-2018-11344

CVE-2018-11344 concerns ASUSTOR ADM 3.1.0.RFQ3 on AS6202T. A path traversal vulnerability in download.cgi via the file1 parameter allows an attacker to download arbitrary files from the system. Affected component: download.cgi; root cause: improper validation of file paths in file1. Proof of impa...

CVE-2018-11345

ASUSTOR AS6202T ADM 3.1.0.RFQ3 is affected by CVE-2018-11345: an unrestricted file upload vulnerability in upload.cgi that allows uploading data via the POST parameter filename and, due to path traversal in that parameter, placing files anywhere on the filesystem. This can enable attacker-control...

CVE-2018-11346

CVE-2018-11346 affects ASUSTOR NAS model AS6202T running ADM 3.1.0.RFQ3. The vulnerability is an insecure direct object reference in download.cgi that can reference the action "download_sys_settings" and then specify arbitrary files across the system via the act parameter. The provided documents ...

CVE-2018-11345

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

CVE-2018-11342

CVE-2018-11342 describes a path traversal flaw in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically in the fileExplorer.cgi component. An attacker can exploit the dest_folder parameter to specify arbitrary file system paths and create folders, potentially impacting confidentiality and integrity of the...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. An arbitrary file upload vulnerability exists in the importuser.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3, which stems from the program's failure to validate file extensions. An attacker can...

PT-2018-10499

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to navigate the file system via the filename parameter in the importuser.cgi. This is a directory traversal issue. Recommendations For ASUSTOR AS6202T ADM version...

CVE-2018-11345: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

PT-2018-10502

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue exists, allowing attackers to specify any file on the system for download using the file1 parameter in the "download.cgi" endpoint. Recommendations For ASUSTOR AS6202T A...

CVE-2018-11341: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

CVE-2018-11344: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

CVE-2018-11346: Direct Request

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

PT-2018-10498

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to upload supplied data to a specified filename due to an unrestricted file upload vulnerability in importuser.cgi. This can be used to place attacker-controlled cod...

PT-2018-10504

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows for an insecure direct object reference, enabling access to arbitrary files throughout the system. This is achieved by referencing the "download sys settings" action and...

PT-2018-10500

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue in the fileExplorer.cgi component allows attackers to specify arbitrary paths to system files, enabling them to create folders using the dest folder parameter...

CVE-2018-11340: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed...

CVE-2018-11342: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...