CVE-2026-24932
Improper TLS Validation in ADM DDNS Enables MitM Attack
Publication date: 2026-02-03
Last updated on: 2026-02-19
Assigner: ASUSTOR, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| asustor | data_master | From 4.1.0.rhu2 (inc) to 4.3.3.rof1 (inc) |
| asustor | data_master | From 5.0.0.ra82 (inc) to 5.1.2.re51 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the DDNS update function in ASUSTOR ADM does not properly validate the hostname of the DDNS server's TLS/SSL certificate. Even though the connection uses HTTPS, this improper validation allows a remote attacker to perform a Man-in-the-Middle (MitM) attack. Through this attack, the attacker can intercept sensitive information during the DDNS update process, such as the user's account email, MD5 hashed password, and device serial number. [1]
How can this vulnerability impact me? :
The vulnerability can lead to a remote attacker intercepting sensitive information transmitted during the DDNS update process. This includes the user's account email, MD5 hashed password, and device serial number. Such exposure can compromise user accounts and device security. The attack requires no privileges or user interaction and can be executed over the network, making it highly severe. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your ASUSTOR NAS device to ADM version 5.1.2.RE31 or later, where the issue has been fixed. This update properly validates the TLS/SSL certificate hostname during the DDNS update process, preventing Man-in-the-Middle attacks. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a remote attacker to perform a Man-in-the-Middle (MitM) attack and intercept sensitive information such as the user's account email, MD5 hashed password, and device serial number during the DDNS update process. This exposure of sensitive personal and device information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive data from unauthorized access. However, the provided resources do not explicitly discuss compliance impacts or regulatory considerations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know