PT-2025-29718 · Adm · Adm

Engin Aydoğan · Published 2025-07-16 · Updated 2025-07-18 · CVE-2025-7699

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.RH61 ADM version 5.0.0.RIN1 and earlier

Description An improper access control vulnerability exists in the EZ Sync Manager of ADM. Authenticated users can copy arbitrary files from the server file system into their EZSync folder due to a lack of authorization checks on the file parameter of the HTTP request. This allows attackers to access files outside their authorized scope, potentially leading to unauthorized exposure of sensitive data, provided the file has readable permissions for other users on the underlying OS.

Recommendations ADM versions prior to 4.1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ADM versions 4.1.0 through 4.3.3.RH61: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ADM version 5.0.0.RIN1 and earlier: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-7699

Affected Products

Adm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-7699 · Security Note
• https://asustor.com/security/security_advisory_detail?id=46 · Vendor Advisory
• https://reddit.com/r/asustor/comments/1m2uc4c/asustor_new_firmware_release_500rjg2_16072025 · Reddit Post
• https://twitter.com/CVEnew/status/1945435475323531488 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945433170939175189 · Twitter Post