A vulnerability was found in ASUSTOR exFAT Driver up to 1.0.0.r20 (Hardware Driver Software) and classified as very critical. Affected by this issue is some unknown functionality of the file exfat.cgi of the component System Shell. The manipulation as part of a Response leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.

The weakness was published 03/18/2020. This vulnerability is handled as CVE-2019-11689 since 05/02/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/19/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at 151789.

Productinfo

Type

• Hardware Driver Software

Vendor

• ASUSTOR

Name

• exFAT Driver

Version

• 1.0.0.r20

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion