PT-2020-9200 · Asustor · Asustor Exfat Driver

Published 2020-03-18 · Updated 2020-03-24 · CVE-2019-11688

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions ASUSTOR exFAT Driver versions 1.0.0.r20 and earlier

Description An issue was discovered in the license validation process of the ASUSTOR exFAT Driver. Specifically, exfat.cgi and exfatctl accept any certificate for asustornasapi.asustor.com, indicating a missing SSL certificate validation. This issue allows for the acceptance of any certificate, potentially leading to security risks.

Recommendations For ASUSTOR exFAT Driver versions 1.0.0.r20 and earlier, consider disabling the exfat.cgi and exfatctl scripts until a patch is available to address the missing SSL certificate validation issue. Restrict access to these scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-11688

Affected Products

Asustor Exfat Driver

References · 7

• 🔥 https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md · Exploit
• https://asustor.com/app_central/app_detail?id=776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11688 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11688 · Vendor Advisory
• https://t.me/cvenotify/1857 · Telegram Post
• https://t.me/cvenotify/1856 · Telegram Post
• https://t.me/cibsecurity/10575 · Telegram Post