CVE-2018-11340

CVE-2018-11340 concerns an unrestricted file upload in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically the importuser.cgi endpoint. The underlying issue is that the program accepts an uploaded file and saves it with a user-supplied filename, enabling an attacker to place attacker-controlled code on ...

CVE-2018-11344

CVE-2018-11344 concerns ASUSTOR ADM 3.1.0.RFQ3 on AS6202T. A path traversal vulnerability in download.cgi via the file1 parameter allows an attacker to download arbitrary files from the system. Affected component: download.cgi; root cause: improper validation of file paths in file1. Proof of impa...

CVE-2018-11345

ASUSTOR AS6202T ADM 3.1.0.RFQ3 is affected by CVE-2018-11345: an unrestricted file upload vulnerability in upload.cgi that allows uploading data via the POST parameter filename and, due to path traversal in that parameter, placing files anywhere on the filesystem. This can enable attacker-control...

ASUSTOR AS6202T ADM path traversal vulnerability (CNVD-2018-10308)

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A path traversal vulnerability exists in the fileExplorer.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3. An attacker can exploit this vulnerability to create arbitrary folders with the help of t...