CVE Feed

    Dashboard / CVE / CVE-2018-15694

    CVE-2018-15694

    ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled.

    Published:Aug 27, 2018
    Last Modified:Nov 21, 2024
    EPS:Aug 27, 2018
    EPSS Score:0.02118
    CVSS Score:7.5

    Affected Products

    Vendor
    Asustor
    Product
    Data Master

    Exploits

    https://www.tenable.com/security/research/tra-2018-22https://www.tenable.com/security/research/tra-2018-22

    Related CVEs

    CVE-2026-6644 (CVSS 9.4) — A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an ad…
    CVE-2026-6643 (CVSS 8.6) — A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the …
    CVE-2026-3179 (CVSS 9.2) — The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing direc…
    CVE-2026-3100 (CVSS 8.3) — The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to …
    CVE-2026-24936 (CVSS 9.5) — When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validatio…
    CVE-2026-24935 (CVSS 6.3) — A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling ser…
    CVE-2026-24934 (CVSS 6.3) — The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying …
    CVE-2026-24933 (CVSS 8.9) — The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the s…
    CVE-2026-24932 (CVSS 8.9) — The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certifica…
    CVE-2025-13053 (CVSS 7) — When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verif…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High