PT-2023-7627 · Asustor · Asustor Data Master

CVE-2023-2910 · Publicado 2023-08-17 · Atualizado 2023-11-29

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 through 4.1.0 ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below

Description The issue is related to improper neutralization of special elements used in a command, allowing remote unauthorized users to execute arbitrary commands via unspecified vectors. This affects the Printer service functionality in ASUSTOR Data Master (ADM).

Recommendations For ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 through 4.1.0, update to a version above 4.1.0 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue. As a temporary workaround, consider disabling the Printer service functionality in ASUSTOR Data Master (ADM) until a patch is available.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-08687

CVE-2023-2910

Produtos afetados

Asustor Data Master

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-2910 · Aviso do Fabricante
• https://t.me/cibsecurity/68741 · Publicação no Telegram
• https://vuldb.com/?id.237414 · Nota
• https://twitter.com/cracbot/status/1692416115052548202 · Publicação no Twitter
• https://t.me/cvenotify/56729 · Publicação no Telegram
• https://asustor.com/security/security_advisory_detail?id=27 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2910 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08687 · Nota de Segurança