[0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L)
Researchers disclosed command injection in Asustor ADM 3.5.9 music.cgi on the AS602T, rated 8.8.
The 0day Rubbish Research Team publicly disclosed an OS command injection in the media handler of Asustor ADM, verified by static analysis on an AS602T running ADM 3.5.9.RWM1 (x86-64, first-generation G1 image). In music.cgi with act=live, a stored filename breaks argument quoting and reaches system(). The issue is mapped to CWE-78 and CWE-88, with an incomplete denylist, and a primary score of 8.8 with low privileges required. No CVE or in-the-wild exploitation is stated.
- Command injection in Asustor ADM 3.5.9.RWM1 music.cgi on AS602T
- Stored filename breaks quoting and reaches a system() call
- Mapped to CWE-78 and CWE-88; primary score 8.8, PR:L
- Found by static analysis of the G1 firmware image; no CVE listed
- Vendors
- Asustor
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in the media handler of the ADM (ASUSTOR Data Master) management portal, verified by static analysis on the AS602T running ADM 3. 5. 9.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.