CVE-2023-51947

The nasSvr.php file handling NAS server functions does not require any authentication before performing operations on data. An attacker can directly send HTTP requests to this endpoint from the network without needing to possess credentials. In this way, they gain access to various types of data and can modify them arbitrarily. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function).

An attacker can read sensitive data stored on the NAS device without authentication and modify it, leading to a breach of confidentiality and integrity of stored information.

Apply patches available from the manufacturer according to the references. As a temporary measure, it is recommended to restrict network access to the device management panel through firewall rules to prevent unauthorized entities from accessing the administrative interface.

actidata actiNAS SL 2U-8 RDX firmware version 3.2.03-SP1