CVE-2018-12312 - OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter

HIGH

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter

Published Dec 4, 2018

8.8

HIGH

CVSS 3.0

EPSS 3.44%

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter.

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4286		Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Dec 4, 2018

Updated Aug 5, 2024

Reserved Jun 13, 2018

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner mitre

Published Dec 4, 2018

Updated Aug 5, 2024

Exploited since n/a