Vulnerability · Published Dec 12, 2025 · Assigned by ASUSTOR1

CVE-2025-13053A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM

High 7.0

In plain English

A high-severity security flaw in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)<0.1%top 99.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic between the client and server can perform a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the UPS server configuation. This issue affects ADM: from 4.1.0 through 4.3.3.RKD2, from 5.0.0 through 5.1.0.RN42.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1.0 – through 4.3.3.RKD25.0.0 – through 5.1.0.RN42

Weakness: CWE-311 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:L

References

https://www.asustor.com/security/security_advisory_detail?id=49 vendor-advisory