Medium severity · published Aug 22, 2023
CVE-2023-3699
An Improper Privilege Management vulnerability was found on the ADM
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
ADM · ASUSTOR
4.0 through 4.0.6.RIS1; 4.1 through 4.1.0.RLQ1; 4.2 through 4.2.2.RI61 · source: vendor
DM
Data Master · Asustor
4.0.6.ris1 before 4.2.3.rk91 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3699
Vendor Advisory
https://www.asustor.com/security/security_advisory_detail?id=29
More from ADM
10.0
CVE-2023-2909
A Directory traversal vulnerability was found on EZ Sync service of ADM
9.8
CVE-2026-24936
An improper input validation vulnerability was found in ADM while joining a AD Domain.
9.8
CVE-2023-30770
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation
9.8
CVE-2018-11510
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the…
8.8
CVE-2023-3697
A Command injection vulnerability was found on Printer service of ADM