CVE-2023-3699: An Improper Privilege Management vulnerability was found on the ADM

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-22 · updated 2026-06-17
Weakness: CWE-269

Description

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

Affected products

Tenable ASUSTOR Data Master: from 4.0.6.ris1 before 4.2.3.rk91 — fixed in 4.2.3.rk91

How to fix

Upgrade to a fixed version: Tenable ASUSTOR Data Master 4.2.3.rk91. Check the vendor advisory for mitigations.

References

https://www.asustor.com/security/security_advisory_detail?id=29
https://www.asustor.com/security/security_advisory_detail?id=29

Get alerted when CVE-2023-3699 or the next vulnerability affects your stack