Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2025-13053

A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic between the client and server can perform a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the UPS server configuation. This issue affects ADM: from 4.1.0 through 4.3.3.RKD2, from 5.0.0 through 5.1.0.RN42.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR ADM

Default version status: unaffected

  • 4.1.0 to ≤ 4.3.3.RKD2affected
  • 5.0.0 to ≤ 5.1.0.RN42affected

References