What’s Vulnerable › Vulnerabilities

CVE-2023-2749: A Gain Information vulnerability was found on Download Center.

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-31 · updated 2026-06-17
• Weakness: CWE-200

Description

Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below.

Affected products

• ASUSTOR Download Center: from 1.1.5 before 1.1.5.r1298 — fixed in 1.1.5.r1298

How to fix

Upgrade to a fixed version: ASUSTOR Download Center 1.1.5.r1298. Check the vendor advisory for mitigations.

References

• https://www.asustor.com/security/security_advisory_detail?id=24
• https://www.asustor.com/security/security_advisory_detail?id=24

Get alerted when CVE-2023-2749 or the next vulnerability affects your stack