Skip to content
Noroxi

ASUSTOR records

62 published records for vendor asustor.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 22
  4. 23
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

62 records
  • CVE-2018-11510
    52Plan

    The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cg

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    asustor · admJun 28, 2018

  • CVE-2018-11509
    43Plan

    ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are instal

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    asustor · asustor data masterAug 16, 2018

  • CVE-2018-11511
    42Plan

    The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'a

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    asustor · asustor data masterAug 16, 2018

  • CVE-2018-12313
    40Plan

    OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "ro

    CriticalCVSS 9.8No exploitEPSS 4%

    asustor · data masterDec 4, 2018

  • CVE-2023-2909
    40Plan

    A Directory traversal vulnerability was found on EZ Sync service of ADM

    CriticalCVSS 10.0No exploitEPSS 0%

    asustor · admMay 31, 2023

  • CVE-2023-30770
    39Monitor

    A stack-based buffer overflow vulnerability was found in the ADM

    CriticalCVSS 9.8No exploitEPSS 0%

    asustor · admApr 17, 2023

  • CVE-2026-6644
    38Monitor

    A command injection vulnerability was found in the PPTP VPN Clients on the ADM

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    asustor · data masterApr 20, 2026

  • CVE-2026-24936
    38Monitor

    An improper input validation vulnerability was found in ADM while joining a AD Domain.

    CriticalCVSS 9.5No exploitEPSS 0%

    asustor · data masterFeb 3, 2026

  • CVE-2018-12317
    36Monitor

    OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" P

    HighCVSS 8.8No exploitEPSS 3%

    asustor · data masterDec 4, 2018

  • CVE-2018-12307
    36Monitor

    OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parame

    HighCVSS 8.8No exploitEPSS 3%

    asustor · data masterDec 4, 2018

  • CVE-2018-12316
    36Monitor

    OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST p

    HighCVSS 8.8No exploitEPSS 3%

    asustor · data masterDec 4, 2018

  • CVE-2018-12312
    36Monitor

    OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL p

    HighCVSS 8.8No exploitEPSS 3%

    asustor · data masterDec 4, 2018

  • CVE-2018-11345
    36Monitor

    An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the P

    HighCVSS 8.8No exploitEPSS 1%

    asustor · as6202t firmwareMay 21, 2018

  • CVE-2026-3179
    36Monitor

    A path traversal vulnerability was found in the FTP Backup on the ADM.

    CriticalCVSS 9.2No exploitEPSS 0%

    asustor · data masterFeb 25, 2026

  • CVE-2023-2910
    35Monitor

    A Command injection vulnerability was found on Printer service of ADM

    HighCVSS 8.8No exploitEPSS 1%

    asustor · data masterAug 17, 2023

  • CVE-2018-12318
    35Monitor

    Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext.

    HighCVSS 8.8No exploitEPSS 1%

    asustor · data masterDec 4, 2018

  • CVE-2022-37398
    35Monitor

    A stack-based buffer overflow vulnerability was found on ADM

    HighCVSS 8.8No exploitEPSS 0%

    asustor · admAug 5, 2022

  • CVE-2023-3697
    35Monitor

    A Command injection vulnerability was found on Printer service of ADM

    HighCVSS 8.8No exploitEPSS 0%

    asustor · data masterAug 17, 2023

  • CVE-2026-24932
    35Monitor

    An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.

    HighCVSS 8.9No exploitEPSS 0%

    asustor · data masterFeb 2, 2026

  • CVE-2026-24933
    35Monitor

    An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.

    HighCVSS 8.9No exploitEPSS 0%

    asustor · data masterFeb 2, 2026

  • CVE-2026-67244
    34Monitor

    A format string vulnerability was found in the Notification OAuth settings of ADM

    HighCVSS 8.6No exploitEPSS 0%

    asustor · data masterJul 30, 2026

  • CVE-2026-67248
    34Monitor

    A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM

    HighCVSS 8.7No exploitEPSS 0%

    asustor · data masterJul 30, 2026

  • CVE-2026-6643
    34Monitor

    A stack-based buffer overflow vulnerability in the VPN Clients on the ADM

    HighCVSS 8.6Proof of conceptEPSS 0%

    asustor · data masterApr 20, 2026

  • CVE-2019-11689
    33Monitor

    An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20.

    HighCVSS 8.1No exploitEPSS 3%

    asustor · exfat driverMar 18, 2020

  • CVE-2026-3100
    33Monitor

    An improper certificate validation vulnerability was found in the FTP Backup on the ADM.

    HighCVSS 8.3No exploitEPSS 0%

    asustor · data masterFeb 25, 2026