CVE-2018-11510
57Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 45%
from disclosure to weapon0 days
Published on NVDJun 28
1st PoCJun 18
VulnCheck+238d
exploitation probability
45%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
Affected products
n/a · n/apublic PoCs found — 7
githubgithub.com/mefulton/CVE-2018-11510★ 0cve_referencewww.exploit-db.com/exploits/45212/unverifiedcve_referencepacketstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlunverifiedexploitdbwww.exploit-db.com/exploits/45212unverifiedcve_referencewww.exploit-db.com/exploits/45200/unverifiedvulncheckvulncheck.com/xdb/6c8e49b96b20unverifiedexploitdbwww.exploit-db.com/exploits/45200unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlhttps://github.com/mefulton/CVE-2018-11510https://github.com/mefulton/CVE-2018-11510/blob/master/admex.pyhttps://www.exploit-db.com/exploits/45200/https://www.exploit-db.com/exploits/45212/