Vulnerability details
CVE-2026-24932
ASUSTOR ADM
An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.
CVSS 4.0
8.9High
Official description
The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email, MD5 hashed password, and device serial number.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.1.RCI1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.9High | 4.0 | CVEProject cvelistV5 (CNA) (ASUSTOR1) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| ASUSTOR | ADM | 4.1.0 ≤ v ≤ 4.3.3.ROF1 | CVEProject cvelistV5 (CNA) |
| ASUSTOR | ADM | 5.0.0 ≤ v ≤ 5.1.1.RCI1 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.asustor.com/security/security_advisory_detail?id=50 vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-03
- Last updated
- 2026-02-03
- State
- Published
- Assigner (CNA)
- ASUSTOR1
Exploit prediction (EPSS)
0.21%
Probability of exploitation in 30 days
12.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-295Improper Certificate Validation