Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in the media handler of the ADM (ASUSTOR Data Master) management portal, verified by static analysis on the AS602T running ADM 3.5.9.RWM1 (x86-64, first- generation G1 firmware line, from the distributed image ADM_X64_G1_3.5.9.RWM1_AS602T.img). Type: OS command injection (CWE-78), enabled by an argument-quoting breakout (CWE-88) and by an incomplete list of disallowed values...