Vulnerability details
CVE-2026-3100
ASUSTOR ADM
An improper certificate validation vulnerability was found in the FTP Backup on the ADM.
CVSS 4.0
8.3High
Official description
The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.3High | 4.0 | CVEProject cvelistV5 (CNA) (ASUSTOR1) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| ASUSTOR | ADM | 4.1.0 ≤ v ≤ 4.3.3.ROF1 | CVEProject cvelistV5 (CNA) |
| ASUSTOR | ADM | 5.0.0 ≤ v ≤ 5.1.2.RE51 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.asustor.com/security/security_advisory_detail?id=53 vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-25
- Last updated
- 2026-02-27
- State
- Published
- Assigner (CNA)
- ASUSTOR1
Exploit prediction (EPSS)
0.19%
Probability of exploitation in 30 days
9.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-295Improper Certificate Validation