[0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-06 17:44 UTC
Importiert: 2026-10-06 18:50 UTC
Quelle-ID: full_disc
uid_hash: 72875fd323b0364399673e61c9fb5e4d786dc81030771025ca8a9dcfd06b35a6

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in the

media handler of the ADM (ASUSTOR Data Master) management portal, verified by

static analysis on the AS602T running ADM 3.5.9.RWM1 (x86-64, first-

generation G1 firmware line, from the distributed image

ADM_X64_G1_3.5.9.RWM1_AS602T.img).

Type: OS command injection (CWE-78), enabled by an argument-quoting breakout

(CWE-88) and by an incomplete list of disallowed values...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss