VULNERABILITY INTELLIGENCE

CVE-2023-2909

CVSS score8.5 HIGH
EPSS probability0.67%
CISA KEVNot currently listed
Published2023-05-31
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Weakness classification

  • security@asustor.com: CWE-22
  • nvd@nist.gov: CWE-22

Primary references