CVE-2023-2749: asustor download_center
Vulnerability summary
CVE-2023-2749 is a high (CVSS 8.6) vulnerability in asustor download_center. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.7% of scored vulnerabilities.
Timeline
- 31-05-2023PublishedVulnerability first disclosed.
- 09-01-2025Last modifiedVulnerability information updated.
Description
Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.46% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
Affected systems
Asustor1 product
- download_center≥ 1.1.5, ≤ 1.1.5.r1280 | ≥ 1.1.5, < 1.1.5.r1298
1 vendor · 1 product
References
1 links- www.asustor.com/security/security_advisory_detail?id=24Vendor Advisory