Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-24934

An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR ADM

Default version status: unaffected

  • 4.1.0 to ≤ 4.3.3.ROF1affected
  • 5.0.0 to ≤ 5.1.1.RCI1affected

References