PT-2023-7627 · Asustor · Asustor Data Master

Published 2023-08-17 · Updated 2023-11-29 · CVE-2023-2910

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 through 4.1.0 ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below

Description The issue is related to improper neutralization of special elements used in a command, allowing remote unauthorized users to execute arbitrary commands via unspecified vectors. This affects the Printer service functionality in ASUSTOR Data Master (ADM).

Recommendations For ASUSTOR Data Master (ADM) versions 4.0.6.RIS1 through 4.1.0, update to a version above 4.1.0 to resolve the issue. For ASUSTOR Data Master (ADM) versions 4.2.2.RI61 and below, update to a version above 4.2.2.RI61 to resolve the issue. As a temporary workaround, consider disabling the Printer service functionality in ASUSTOR Data Master (ADM) until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-08687

CVE-2023-2910

Affected Products

Asustor Data Master

References · 8

• https://osv.dev/vulnerability/CVE-2023-2910 · Vendor Advisory
• https://asustor.com/security/security_advisory_detail?id=27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2910 · Security Note
• https://bdu.fstec.ru/vul/2023-08687 · Security Note
• https://t.me/cibsecurity/68741 · Telegram Post
• https://vuldb.com/?id.237414 · Note
• https://twitter.com/cracbot/status/1692416115052548202 · Twitter Post
• https://t.me/cvenotify/56729 · Telegram Post