CVE Feed

    Dashboard / CVE / CVE-2023-4475

    CVE-2023-4475

    An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

    Published:Aug 22, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 22, 2023
    EPSS Score:0.00074
    CVSS Score:7.5

    Affected Products

    Vendor
    Asustor
    Product
    Data Master

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-150 Collect Data from Common Resource Locations
    CAPEC-639 Probe System Files

    Related CVEs

    CVE-2026-6644 (CVSS 9.4) — A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an ad…
    CVE-2026-6643 (CVSS 8.6) — A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the …
    CVE-2026-3179 (CVSS 9.2) — The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing direc…
    CVE-2026-3100 (CVSS 8.3) — The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to …
    CVE-2026-24936 (CVSS 9.5) — When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validatio…
    CVE-2026-24935 (CVSS 6.3) — A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling ser…
    CVE-2026-24934 (CVSS 6.3) — The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying …
    CVE-2026-24933 (CVSS 8.9) — The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the s…
    CVE-2026-24932 (CVSS 8.9) — The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certifica…
    CVE-2025-13053 (CVSS 7) — When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verif…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High