CVE-2018-11509

This issue is about “default credentials” being reused. Imagine every room in your office building has the same master key—an attacker who finds that key can enter rooms you didn’t intend to be accessible.

In this case, apps installed from ASUSTOR’s online repository may end up using the same default root account/password as the NAS itself, which could let someone log in and place a web “backdoor” (webshell) to run commands later.

This matters if you run ASUSTOR Data Master using ADM 3.1.0.RFQ3 and you install applications from the online repository feature.

It’s a risk only when an attacker can reach those app components using the default root:admin credentials—meaning the attacker must be able to access the device/app login surface (for example, via exposed network access) and the default credentials must not have been changed.

This is urgent because public exploitation material exists, so attackers do not need to guess—they can try known methods. While a fixed patch version wasn’t found in the available information, the credential issue is exactly the kind attackers target quickly.

Treat this as a priority for today: verify whether you’re on the affected ADM release and whether any online-repository apps are installed, then remove/disable what you don’t need and change the default root credentials immediately.

1. Confirm exposure on the device

   • Log in to your ASUSTOR Data Master and verify the firmware matches ADM 3.1.0.RFQ3.
   • Identify whether you have installed any apps from ASUSTOR’s online repository.

2. Determine whether default root:admin is still in use for app components

   • Look for device/app account settings related to the root credentials used by installed apps.
   • If you cannot find a way to change app-level credentials separately, assume the worst case implied by the finding and treat any installed online-repository apps as risky unless removed.

3. Immediate mitigation (no patch available in provided info)

   • Change the root credentials on the NAS (do not leave root:admin).
   • Remove or disable non-essential online-repository apps, especially those that you didn’t install intentionally.

4. If you must keep an app

   • Ask ASUSTOR support for the official mitigation steps specific to CVE-2018-11509 and your ADM version.
   • Document the app names and install method so support can correlate your setup.

5. What to monitor while waiting for guidance

   • Watch for unexpected configuration changes or new/admin-like access attempts.
   • Check for signs of webshell-like behavior in the app/NAS web-serving areas (for example, unusual uploaded executable scripts), using whatever monitoring/filesystem inspection tools ASUSTOR provides.

6. Fix status and timeline

   • The available information includes no specific fixed version/patch. Contact ASUSTOR for an updated ADM/app release that addresses CVE-2018-11509.

Severity and mechanism: This is categorized as critical (as provided) and involves CWE-798, which is “Use of Hard-coded Credentials.” The finding states that ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin credentials for apps installed from the online repository.

Attack vector: An attacker can authenticate to the app component that inherits the default credentials, then upload a webshell (a persistent web-access backdoor) to gain further control.

Exploitation status: Public exploit/weaponization is available (2 known). KEV listing was not found in the provided findings, so CISA confirmation is not established here.

Likelihood indicators: EPSS is provided (prediction, trend flat), but since public exploits exist, practical risk should be treated as real for exposed/default-credential setups.

Patch availability: No fix/patch information is available in the provided findings, so the remediation guidance relies on credential change and app removal/disablement, plus vendor follow-up for an actual fixed release.