CVE-2023-51948 is a high severity site wide directory listing in the /fm path of actidata actiNAS SL 2U-8 RDX 3.2.03-SP1, scored 7.5. Remote users can list the files the web application serves. A fix is not confirmed, so keep the interface off untrusted networks.
What's affected
CVE-2023-51948 affects the /fm path of the web application on actiNAS SL 2U-8 RDX, firmware 3.2.03-SP1. NVD published it on 2024-01-19 with a score of 7.5 (high) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
The reporter says visiting that path shows the structure of the web application. They tested one product and version, say other versions may be affected, and did not verify it. I found no fixed firmware. The weakness is tracked as CWE-548, exposure of information through directory listing.
It is paired with CVE-2023-51947, a missing authentication flaw on the same device. The reporter says the listing exposes client side files that show how the server interface is called, which makes the other flaw easier to use.
Weakness class: CWE-548.
How to check if you're exposed
Check the firmware version in the device's web interface and compare it to 3.2.03-SP1.
Test from outside your management network whether the device's web port is reachable. A path listing that works from the internet is a sign the device is exposed.
Review your web access logs, if the device or a front proxy keeps them, for visits to unusual paths from external addresses.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- Inventory actiNAS devices and firmware versions.
- Restrict the web interface to a management network or VPN.
- Ask actidata for a firmware release that disables directory listing and for a statement of affected versions.
- Treat this finding together with CVE-2023-51947. Fixing only the listing leaves the missing authentication in place.
- Re-test from outside after any change to confirm the path no longer lists files.
Why it matters
A directory listing looks minor, and by itself it mostly leaks names and structure. It matters because attackers use it as reconnaissance: file names, scripts and client code tell them which functions exist and how to call them. The reporter makes exactly that link to the sibling flaw.
On a storage appliance the files served may also include logs or backups, depending on configuration, which raises the confidentiality impact. The record's KEV flag is false and I found no report of exploitation.
Quick check
Is a directory listing really high severity?
NVD scores it 7.5 because the listing is reachable over the network with no login and exposes data. The practical risk is higher when it is combined with other flaws on the same device.
What is the quickest mitigation?
Take the web interface off untrusted networks. The listing cannot be reached if the attacker cannot reach the port.
Sources
Reporter write-up for CVE-2023-51948 (fetched, third party)
actiNAS product page (listed in the record, not fetched)
NVD record for CVE-2023-51948 (the record this guide is built from)
Last reviewed: 19 October 2026.
