What’s Vulnerable › Vulnerabilities

CVE-2023-2909: A Directory traversal vulnerability was found on EZ Sync service of ADM

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-31 · updated 2026-06-17
• Weakness: CWE-22

Description

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Affected products

• ASUSTOR ADM: from 4.0.0 through 4.0.6.reg2; from 4.1.0 through 4.1.0rlq1; from 4.2.0 through 4.2.1.rge2

References

• https://www.asustor.com/security/security_advisory_detail?id=25
• https://www.asustor.com/security/security_advisory_detail?id=25

Get alerted when CVE-2023-2909 or the next vulnerability affects your stack