GCVE - cpe:2.3:o:asustor:as6202t_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:asustor:as6202t_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Asustor (`a60ead7f-da26-5f6a-b441-3328916770d4`)
Product	As6202T Firmware (`f3e6c6dc-86b9-5211-92a2-e9b10dade066`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-11346`	vulnerable	2026-06-08 05:10:38.372767	Details available An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act parameter. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:53.000Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11345`	vulnerable	2026-06-08 05:10:38.372424	Details available An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is vulnerable to path traversal and allows the attacker to place the file anywhere on the system. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:52.891Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11344`	vulnerable	2026-06-08 05:10:38.372044	Details available A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:52.919Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11342`	vulnerable	2026-06-08 05:10:38.369517	Details available A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:52.884Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11341`	vulnerable	2026-06-08 05:10:38.369136	Details available Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:52.966Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11340`	vulnerable	2026-06-08 05:10:38.367762	Details available An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed. Published: 2018-05-22T01:00:00.000Z Updated: 2024-08-05T08:01:53.076Z Open on db.gcve.eu Reference links https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation https://github.com/mefulton/asustorexploit http://seclists.org/fulldisclosure/2018/May/2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.