CVE-2018-11509
📋 TL;DR
This vulnerability in ASUSTOR NAS ADM software allows attackers to gain administrative access using default credentials (root:admin) for installed applications. Attackers can then upload webshells and execute arbitrary commands. All ASUSTOR NAS devices running ADM 3.1.0.RFQ3 with applications from the online repository are affected.
💻 Affected Systems
- ASUSTOR NAS devices with ADM software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data theft, ransomware deployment, and persistent backdoor installation.
Likely Case
Unauthorized administrative access leading to data exfiltration, system manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact if default credentials are changed and proper network segmentation is implemented.
🎯 Exploit Status
Exploitation requires knowledge of default credentials but is straightforward once obtained. Multiple public exploit scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ADM 3.1.1 and later
Vendor Advisory: https://www.asustor.com/en-gb/security/security_advisory?product=ADM&id=1
Restart Required: Yes
Instructions:
1. Log into ADM web interface. 2. Navigate to Settings > ADM Update. 3. Check for and install ADM 3.1.1 or later. 4. Restart the NAS when prompted.
🔧 Temporary Workarounds
Change Default Application Credentials
allChange the default root:admin password for all installed applications
Login to ADM web interface > Access Control > Users > Edit root user > Change password
Disable Unnecessary Applications
allRemove or disable applications not in use to reduce attack surface
Login to ADM web interface > App Central > Select application > Uninstall
🧯 If You Can't Patch
- Immediately change all default credentials, especially for the root/admin accounts
- Implement network segmentation to isolate NAS from internet and restrict internal access
🔍 How to Verify
Check if Vulnerable:
Check ADM version in Settings > ADM Update. If version is 3.1.0.RFQ3 and applications are installed, system is vulnerable.Check Version:
ssh admin@nas-ip 'adm version' or check web interface Settings > ADM UpdateVerify Fix Applied:
Verify ADM version is 3.1.1 or later in Settings > ADM Update. Confirm default credentials no longer work for application access.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful root/admin login
- Unusual file uploads to web directories
- Suspicious command execution in system logs
Network Indicators:
- Unexpected outbound connections from NAS
- Unusual traffic to NAS management ports (8000, 8001)
SIEM Query:
source="asustor_nas" AND (event_type="authentication" AND user="root" AND result="success") OR (event_type="file_upload" AND path LIKE "%.php" OR path LIKE "%.jsp")🔗 References
- http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
- https://www.exploit-db.com/exploits/45200/
- http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
- https://www.exploit-db.com/exploits/45200/
