WTF Asustor? Should I be worried?

[chazzz]

NAS: AS-202TE
ADM version: 3.0.5.RDU1

First time seeing a successful unauthorized login. I then tried it myself and it worked, using "nvradmin" as both user name and password. From the looks of it you can't do much with the unauthorized login because no file access rights were given. But I'm no IT expert so should I be worried? Is there anything I can do within the NAS setting to prevent this from happening again?

IMG_7368.JPG (109.53 KiB) Viewed 4231 times

nvradmin.png (515.57 KiB) Viewed 4231 times

[mafredri]

Oh wow, that definitely falls under the not cool category.

You can log in to the NAS via SSH (e.g. Putty, use root@nas) and type in the following command:

Code: Select all

passwd -l nvradmin

-l is for lock and will prevent logins for the account.

[MonsMagnus]

WOW!! I just checked this on my AS6202T and it works there as well. I agree that while this user doesn't appear to have any privileges, a hidden user account that I knew nothing about is NOT COOL. Asustor needs to secure this ASAP. I will be filing a service ticket on this as well.