What’s Vulnerable › Vulnerabilities

CVE-2018-11510

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 44.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-28 · updated 2026-06-17
• Weakness: CWE-78

Description

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.

Affected products

• ASUSTOR ADM: through 3.1.2.rhg1

References

• http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
• https://github.com/mefulton/CVE-2018-11510
• https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
• https://www.exploit-db.com/exploits/45200/
• https://www.exploit-db.com/exploits/45212/
• http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
• https://github.com/mefulton/CVE-2018-11510
• https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
• https://www.exploit-db.com/exploits/45200/
• https://www.exploit-db.com/exploits/45212/

Get alerted when CVE-2018-11510 or the next vulnerability affects your stack