CVE-2026-24933
Improper SSL Validation in ADM API Enables MitM Attack
Publication date: 2026-02-03
Last updated on: 2026-02-19
Assigner: ASUSTOR, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| asustor | data_master | From 4.1.0.rhu2 (inc) to 4.3.3.rof1 (inc) |
| asustor | data_master | From 5.0.0.ra82 (inc) to 5.1.2.re51 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated remote attacker to perform a Man-in-the-Middle (MitM) attack by exploiting improper SSL/TLS certificate validation. As a result, sensitive user information such as account emails, MD5 hashed passwords, and device serial numbers can be exposed in cleartext during communication.
Exposure of sensitive personal data through this vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information during transmission.
Can you explain this vulnerability to me?
This vulnerability occurs because the API communication component does not properly validate SSL/TLS certificates when making HTTPS requests. This flaw allows an unauthenticated remote attacker to perform a Man-in-the-Middle (MitM) attack, intercepting the communication in cleartext. As a result, sensitive user information such as account emails, MD5 hashed passwords, and device serial numbers can be exposed.
How can this vulnerability impact me? :
The vulnerability can lead to the exposure of sensitive user information by allowing an attacker to intercept communications between the client and server. This can result in unauthorized access to account emails, hashed passwords, and device serial numbers, potentially compromising user accounts and device security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know