← back
CVE-2018-11509

CVE-2018-11509

EPSS 12.6%
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/45200/unverifiedexploitdbwww.exploit-db.com/exploits/45200unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlhttps://www.exploit-db.com/exploits/45200/