data master · threatengine.sh

Home/Product/asustor data master

Product

asustor data master

37 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 4.1.0.rhu2 and < 4.3.3.RR42

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to

>= 4.1.0.rhu2 and < 4.3.3.RR42

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded ssc

>= 4.1.0.rhu2 and <= 4.3.3.rof1

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A mal

>= 4.1.0.rhu2 and <= 4.3.3.rof1

The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using

>= 4.1.0.rhu2 and <= 4.3.3.rof1

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a

>= 4.1.0.rhu2 and <= 4.3.3.rof1

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequen

>= 4.1.0.rhu2 and <= 4.3.3.rof1

The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server f

>= 4.1.0.rhu2 and <= 4.3.3.rof1

The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper c

>= 4.1.0.rhu2 and <= 4.3.3.rof1

The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the con

>= 4.1.0.RHU2 and < 4.3.3.ROF1

When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an

>= 4.1.0.RHU2 and < 4.3.3.ROF1

When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificate

>= 4.0.6.ris1 and < 4.2.2.ri61

An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming fe

>= 4.0.6.ris1 and < 4.2.3.rk91

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify

>= 4.0.0.rib4 and <= 4.0.6.ris1

Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended direc

>= 4.0.0.rib4 and <= 4.0.6.ris1

Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended direc

>= 4.0.0.rib4 and <= 4.0.6.ris1

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality

Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed te

Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in clea

OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying th

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filen

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipula

OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication v

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript

Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announce

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifyin

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" P

Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1

Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images

ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.c

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations du

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin