CVE-2018-11510

high-risk
Published 2018-06-28

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.

Do I need to act?

!
89.4% chance of exploitation in next 30 days
EPSS score — higher than 11% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
2 public exploits available
45200, 45212
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Adm

Affected Vendors

Asustor

References (10)

Exploit http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command...
Exploit https://github.com/mefulton/CVE-2018-11510
Exploit https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
Exploit https://www.exploit-db.com/exploits/45200/
Exploit https://www.exploit-db.com/exploits/45212/
Exploit http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command...
Exploit https://github.com/mefulton/CVE-2018-11510
Exploit https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
Exploit https://www.exploit-db.com/exploits/45200/
Exploit https://www.exploit-db.com/exploits/45212/
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal