CVE-2018-11509: Asustor Data Master

Critical severity, CVSS 9.8. EPSS: 12.6% chance of exploitation in the next 30 days.

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.

Affected products

• Asustor Asustor Data Master: version 3.1.0 only

Published 2018-08-16. Last modified 2026-06-17.