CVE-2019-11689

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.mdExploit, Third Party Advisory
https://www.asustor.com/app_central/app_detail?id=776Vendor Advisory
https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.mdExploit, Third Party Advisory
https://www.asustor.com/app_central/app_detail?id=776Vendor Advisory

Timeline

Published: Mar 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-11697.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An CVE-2019-116905.9gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in CVE-2019-116919.8A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called a CVE-2019-116929.8A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a poten CVE-2019-116939.8The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious CVE-2019-116947.5A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a CVE-2019-116954.3A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allo CVE-2019-116967.8Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though CVE-2019-116976.5If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install CVE-2019-116985.3If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped CVE-2019-116996.5A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could CVE-2019-11707.9An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker w