Vulnerability · Published Feb 3, 2026 · Assigned by ASUSTOR1

CVE-2026-24935An improper certificate validation vulnerability was found in a third-party NAT traversal module.

Medium 6.3

In plain English

A medium-severity improper certificate validation in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 95.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1.0 – through 4.3.3.ROF15.0.0 – through 5.1.1.RCI1

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://www.asustor.com/security/security_advisory_detail?id=50 vendor-advisory