CVE Feed

    Dashboard / CVE / CVE-2023-3699

    CVE-2023-3699

    An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

    Published:Aug 22, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 22, 2023
    EPSS Score:0.00049
    CVSS Score:8.7

    Affected Products

    Vendor
    Asustor
    Product
    Data Master

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-6644 (CVSS 9.4) — A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an ad…
    CVE-2026-6643 (CVSS 8.6) — A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the …
    CVE-2026-3179 (CVSS 9.2) — The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing direc…
    CVE-2026-3100 (CVSS 8.3) — The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to …
    CVE-2026-24936 (CVSS 9.5) — When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validatio…
    CVE-2026-24935 (CVSS 6.3) — A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling ser…
    CVE-2026-24934 (CVSS 6.3) — The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying …
    CVE-2026-24933 (CVSS 8.9) — The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the s…
    CVE-2026-24932 (CVSS 8.9) — The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certifica…
    CVE-2025-13053 (CVSS 7) — When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verif…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High