by Kastro
Paper/Archive/CVE-2023-2909

CVE-2023-2909

ASUSTOR ADM — A Directory traversal vulnerability was found on EZ Sync service of ADM

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 52.1.521 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Affected

ProductAffectedFixed inSource
ADM4.0 – 4.0.6.REG2–CNA
ADM4.1 – 4.1.0.RLQ1–CNA
ADM4.2 – 4.2.1.RGE2–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ASUSTOR1 (CNA)8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryasustor.com/security/security_advisory_detail?id=25