Vulnerability · Published Feb 3, 2026 · Assigned by ASUSTOR1

CVE-2026-24934An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.

Medium 6.3

In plain English

A medium-severity improper certificate validation in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 94.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1.0 – through 4.3.3.ROF15.0.0 – through 5.1.1.RCI1

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

https://www.asustor.com/security/security_advisory_detail?id=50 vendor-advisory