CVE-2023-51947 is a critical missing authentication flaw in the web interface of actidata actiNAS SL 2U-8 RDX 3.2.03-SP1, scored 9.1. Anyone who can reach it can read and change data without logging in. A fix is not confirmed, so isolate the device from untrusted networks.
What's affected
CVE-2023-51947 affects the nasSvr.php endpoint in the web application of actidata actiNAS SL 2U-8 RDX, firmware 3.2.03-SP1. NVD published it on 2024-01-19 with a score of 9.1 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
The reporter says the endpoint allows several kinds of read and write operations without authentication, including reading logs and account lists and managing accounts. The reporter tested one product and firmware version and believes others may be affected, but did not verify that. I found no fixed firmware in the sources I read. Ask actidata for one.
This CVE chains with its sibling CVE-2023-51948, a site wide directory listing on the same device, which the reporter says helps an attacker learn how the interface is called.
Weakness class: CWE-306.
How to check if you're exposed
Check the firmware version shown in the device's web interface or on its label, and compare it to 3.2.03-SP1. Menu names vary, so use the product documentation.
Then check reachability. From a machine outside the management network, test whether the device's web port answers. If you can reach it from the internet, a search engine for exposed devices can reach it too.
Look at the device's own logs for account changes you did not make, and compare the list of management accounts with the one you expect.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- Find every actiNAS device and record its model and firmware version.
- Take the management interface off any untrusted network. Put it on an isolated management VLAN or behind a VPN.
- Contact actidata for a fixed firmware release and a statement on which versions are affected.
- Audit management accounts and stored data on any device that was exposed, and reset administrator credentials after you restrict access.
- If the device holds backups, verify backup integrity from a separate copy, since the flaw allows writes.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The server checks nothing before it runs requests that read data or manage accounts. In storage appliances this tends to occur when a management interface was built for a trusted network and then exposed more widely.
The impact scores high on confidentiality and integrity because the device's job is to hold data. The record's KEV flag is false and I found no report of exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need credentials to abuse CVE-2023-51947?
Per the record and the reporter, no. The vector shows no privileges required.
Is there a firmware update?
I could not confirm one. Contact the vendor and check the product page before you assume a fix exists.
Sources
Reporter write-up for CVE-2023-51947 (fetched, third party)
actiNAS product page (listed in the record, not fetched)
NVD record for CVE-2023-51947 (the record this guide is built from)
Last reviewed: 19 October 2026.
