Skip to content
CVE PROGRAM SOURCE RECORD8.9 High

CVE-2026-24932

An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email, MD5 hashed password, and device serial number.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.1.RCI1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR ADM

Default version status: unaffected

  • 4.1.0 to ≤ 4.3.3.ROF1affected
  • 5.0.0 to ≤ 5.1.1.RCI1affected

References