What’s Vulnerable › Vulnerabilities

CVE-2023-2910: A Command injection vulnerability was found on Printer service of ADM

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-17 · updated 2026-06-17
• Weakness: CWE-77

Description

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

Affected products

• Tenable ASUSTOR Data Master: from 4.0.0.rib4 through 4.0.6.ris1; from 4.1.0.rhu2 before 4.2.3.rk91 — fixed in 4.2.3.rk91

How to fix

Upgrade to a fixed version: Tenable ASUSTOR Data Master 4.2.3.rk91. Check the vendor advisory for mitigations.

References

• https://www.asustor.com/security/security_advisory_detail?id=27
• https://www.asustor.com/security/security_advisory_detail?id=27

Get alerted when CVE-2023-2910 or the next vulnerability affects your stack