Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2018-12307 Details

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter.

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc	CVE	ExploitThird Party Advisory
https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc	[email protected]	ExploitThird Party Advisory

CWE-ID	CWE Name	Source
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	[email protected]

Product	Versions
asustor data master	3.1.1
CPE cpe:2.3:o:asustor:data_master:3.1.1:::::::* Remediation No remediation found in references.
asustor as602t	All versions
CPE cpe:2.3:h:asustor:as602t:-:::::::* Remediation No remediation found in references.

4 change records found show changes

QUICK INFO