Vulnerability · Published Aug 17, 2023 · Assigned by ASUSTOR1

CVE-2023-2910A Command injection vulnerability was found on Printer service of ADM

High 8.8

In plain English

A high-severity command injection in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.6%top 24.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.0 – through 4.0.6.RIS14.1 – through 4.1.0.RLQ14.2 – through 4.2.2.RI61

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.asustor.com/security/security_advisory_detail?id=27 vendor-advisory