CVE-2018-11509 - ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository

Back Back to CVE browser

CRITICAL

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository

Published Aug 16, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 12.57%

Description

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (3)

http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3538
Advisory
https://www.exploit-db.com/exploits/45200/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3538		Advisory
https://www.exploit-db.com/exploits/45200/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry