critical9.8Public exploit code
CVE-2018-11509
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ASUSTOR ADM 3.1.0.RFQ3 - Remote Command Execution / SQL Injection2018-08-15 · webapps · cgi
Impact
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asustor | Asustor Data Master | Version 3.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
- https://www.exploit-db.com/exploits/45200/
- http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
- https://www.exploit-db.com/exploits/45200/