Asustor Data Master vulnerabilities

2 vulnerabilities

Known vulnerabilities in Asustor Data Master, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2018-11511asustorasustor_data_master
EPSS score
11.27%
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.9.8CVE-2018-11509asustorasustor_data_master
EPSS score
12.57%
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.