High severity · published Dec 4, 2018
CVE-2018-12307
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter
8.8
CVSS
3.4%
EPSS
No
On KEV
Description
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Data Master · Asustor
3.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12307
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12307
Exploit
https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
More from Data Master
9.9
CVE-2026-6643
A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
9.8
CVE-2026-24936
An improper input validation vulnerability was found in ADM while joining a AD Domain.
9.8
CVE-2018-12313
OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter
9.1
CVE-2026-6644
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
8.8
CVE-2026-67248
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM