PT-2020-9201 · Asustor · Asustor Exfat Driver

Published 2020-03-18 · Updated 2020-08-24 · CVE-2019-11689

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUSTOR exFAT Driver versions 1.0.0.r20 and earlier

Description An issue was discovered in the license validation process of the ASUSTOR exFAT Driver. The exfat.cgi and exfatctl components fail to properly validate server responses, passing unsanitized text to the system shell. This results in code execution as root.

Recommendations For ASUSTOR exFAT Driver versions 1.0.0.r20 and earlier, consider disabling the exfat.cgi and exfatctl components until a patch is available to prevent code execution as root. Restrict access to these components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-11689

Affected Products

Asustor Exfat Driver

References · 6

• 🔥 https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11689 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11689 · Vendor Advisory
• https://asustor.com/app_central/app_detail?id=776 · Vendor Advisory
• https://t.me/cibsecurity/10574 · Telegram Post
• https://t.me/cvenotify/1857 · Telegram Post