CVE-2023-3697: A Command injection vulnerability was found on Printer service of ADM

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-22

Description

Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

Affected products

Tenable ASUSTOR Data Master: from 4.0.0.rib4 through 4.0.6.ris1; from 4.1.0.rhu2 before 4.2.3.rk91 — fixed in 4.2.3.rk91

How to fix

Upgrade to a fixed version: Tenable ASUSTOR Data Master 4.2.3.rk91. Check the vendor advisory for mitigations.

References

https://www.asustor.com/security/security_advisory_detail?id=28
https://www.asustor.com/security/security_advisory_detail?id=28

Get alerted when CVE-2023-3697 or the next vulnerability affects your stack