High severity · published Aug 17, 2023
CVE-2023-3697
Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Data Master · Asustor
4.0.0.rib4 through 4.0.6.ris1; 4.1.0.rhu2 before 4.2.3.rk91 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3697
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3697
Vendor Advisory
https://www.asustor.com/security/security_advisory_detail?id=28
More from Data Master
9.9
CVE-2026-6643
A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
9.8
CVE-2026-24936
An improper input validation vulnerability was found in ADM while joining a AD Domain.
9.8
CVE-2018-12313
OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter
9.1
CVE-2026-6644
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
8.8
CVE-2026-67248
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM