CVE-2023-51947
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
In the actiNAS SL 2U-8 RDX version 3.2.03-SP1, improper access control was found in the nasSvr.php file. A remote attacker can read and modify different types of data without authentication.
Risk Assessment
The risk involves unauthorized access to data stored on the device, potentially leading to information leakage or data modification by unauthorized individuals.
Recommendation
Immediately update the actiNAS software to the latest version that fixes this vulnerability. If an update is not available, restrict access to the nasSvr.php file using a firewall or access control lists.
Original NVD description (English source)
Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.