CVE-2018-12317: Command Injection
Published Dec 4, 2018
·Updated
OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter.
Affected Software
2 affected components
ASUSTOR Data Master=3.1.1
ASUSTOR As-602t
Event History
Dec 4, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this OS command injection in ASUSTOR ADM?
The vulnerability ID for this OS command injection in ASUSTOR ADM is CVE-2018-12317.
2
What is the affected software version for this vulnerability?
The affected software version for this vulnerability is ASUSTOR ADM version 3.1.1.
3
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability by modifying the "name" POST parameter in group.cgi to execute system commands as root.
4
What is the severity of CVE-2018-12317?
The severity of CVE-2018-12317 is critical with a severity value of 8.8.
5
Is the Asustor As-602t vulnerable to this OS command injection vulnerability?
No, the Asustor As-602t is not vulnerable to this OS command injection vulnerability.