CVE-2018-11509

This issue is about “default credentials” being reused. Imagine every room in your office building has the same master key—an attacker who finds that key can enter rooms you didn’t intend to be accessible.

In this case, apps installed from ASUSTOR’s online repository may end up using the same default root account/password as the NAS itself, which could let someone log in and place a web “backdoor” (webshell) to run commands later.

This matters if you run ASUSTOR Data Master using ADM 3.1.0.RFQ3 and you install applications from the online repository feature.

It’s a risk only when an attacker can reach those app components using the default root:admin credentials—meaning the attacker must be able to access the device/app login surface (for example, via exposed network access) and the default credentials must not have been changed.

This is urgent because public exploitation material exists, so attackers do not need to guess—they can try known methods. While a fixed patch version wasn’t found in the available information, the credential issue is exactly the kind attackers target quickly.

Treat this as a priority for today: verify whether you’re on the affected ADM release and whether any online-repository apps are installed, then remove/disable what you don’t need and change the default root credentials immediately.