Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-24935

An improper certificate validation vulnerability was found in a third-party NAT traversal module.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUSTOR1

Description

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUSTOR ADM

Default version status: unaffected

  • 4.1.0 to ≤ 4.3.3.ROF1affected
  • 5.0.0 to ≤ 5.1.1.RCI1affected

References