Back to Database
Status published
High
CVE-2023-2909
A Directory traversal vulnerability was found on EZ Sync service of ADM
Vulnerability Description
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2909
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- JuYang.Gao (chumen77) from Dbappsecurity Co.,Ltd
More from ASUSTOR
View All →CVE-2025-8070
Windows service registered with an unquoted ImagePath vulnerability in the system registry
Critical
9.2
CVE-2025-7699
An improper access control vulnerability was found in the EZ Sync Manager of ADM
High
7.1
CVE-2025-7618
A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADM
Medium
4.8
CVE-2025-7380
A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM
Medium
4.8
CVE-2025-7379
A security bypass vulnerability was found in DataSync Center installed on ADM
Medium
5.2
Affected Vendor
ASUSTOR
View all reports →Affected Software
ADM
Vulnerable Versions:
4.0, 4.1, 4.2
Timeline
Official Publish:
May 31st, 2023
Last Modified:
January 9th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H