Read the docs
TI-2023-02353 Aliases CVE-2023-2509GHSA-69cg-q6pw-v79j

Cross-site scripting in ASUSTOR ADM

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by the browser and used with that application. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below, LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ASUSTORADM4.0 – 4.0.6.REG2; 4.1 – 4.1.0.RLQ1; 4.2 – 4.2.1.RGE2—No fix listedCNA
ASUSTORLooksGood2.0 – 2.0.0.R129—No fix listedCNA
ASUSTORSoundsGood2.3 – 2.3.0.r1027—No fix listedCNA
  • ADM VendorASUSTOR Affected 4.0 – 4.0.6.REG2; 4.1 – 4.1.0.RLQ1; 4.2 – 4.2.1.RGE2 Fixed in — No fix listed CNA
  • LooksGood VendorASUSTOR Affected 2.0 – 2.0.0.R129 Fixed in — No fix listed CNA
  • SoundsGood VendorASUSTOR Affected 2.3 – 2.3.0.r1027 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:asustor:adm:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableASUSTOR
cpe:2.3:a:asustor:adm:4.0.6:reg2:*:*:*:*:*:*4.0.6 reg2VulnerableASUSTOR
cpe:2.3:a:asustor:adm:4.1.0:-:*:*:*:*:*:*4.1.0VulnerableASUSTOR
cpe:2.3:a:asustor:adm:4.1.0:rlq1:*:*:*:*:*:*4.1.0 rlq1VulnerableASUSTOR
cpe:2.3:a:asustor:adm:4.2.1:-:*:*:*:*:*:*4.2.1VulnerableASUSTOR
cpe:2.3:a:asustor:adm:4.2.1:rge2:*:*:*:*:*:*4.2.1 rge2VulnerableASUSTOR
cpe:2.3:a:asustor:looksgood:2.0.0:-:*:*:*:*:*:*2.0.0VulnerableASUSTOR
cpe:2.3:a:asustor:looksgood:2.0.0:r129:*:*:*:*:*:*2.0.0 r129VulnerableASUSTOR
cpe:2.3:a:asustor:soundsgood:2.3.0:-:*:*:*:*:*:*2.3.0VulnerableASUSTOR
cpe:2.3:a:asustor:soundsgood:2.3.0:r1027:*:*:*:*:*:*2.3.0 r1027VulnerableASUSTOR
  • cpe:2.3:a:asustor:adm:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:adm:4.0.6:reg2:*:*:*:*:*:* Versions 4.0.6 reg2 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:adm:4.1.0:-:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:adm:4.1.0:rlq1:*:*:*:*:*:* Versions 4.1.0 rlq1 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:adm:4.2.1:-:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:adm:4.2.1:rge2:*:*:*:*:*:* Versions 4.2.1 rge2 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:looksgood:2.0.0:-:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:looksgood:2.0.0:r129:*:*:*:*:*:* Versions 2.0.0 r129 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:soundsgood:2.3.0:-:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·ASUSTOR
  • cpe:2.3:a:asustor:soundsgood:2.3.0:r1027:*:*:*:*:*:* Versions 2.3.0 r1027 Vulnerable ·ASUSTOR

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2509
  2. 2026-10-03 Alias added: GHSA-69cg-q6pw-v79j

References

Advisory 1

  • TI-2018-08230 The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code… CVSS 3.0CRITICAL 9.8
  • TI-2023-02727 A Directory traversal vulnerability was found on EZ Sync service of ADM CVSS 3.1CRITICAL 10.0
  • TI-2023-14583 A stack-based buffer overflow vulnerability was found in the ADM CVSS 3.1CRITICAL 9.8
  • TI-2022-17472 A stack-based buffer overflow vulnerability was found on ADM CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences