Medium severity · published Aug 22, 2023
CVE-2023-3699
An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Data Master · Asustor
4.0.6.ris1 before 4.2.3.rk91 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3699
Vendor Advisory
https://www.asustor.com/security/security_advisory_detail?id=29
More from Data Master
9.9
CVE-2026-6643
A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
9.8
CVE-2026-24936
An improper input validation vulnerability was found in ADM while joining a AD Domain.
9.8
CVE-2018-12313
OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter
9.1
CVE-2026-6644
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
8.8
CVE-2026-67248
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM