CVE-2026-24934

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24934", "assignerOrgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "state": "PUBLISHED", "assignerShortName": "ASUSTOR1", "dateReserved": "2026-01-28T08:40:24.461Z", "datePublished": "2026-02-03T02:26:55.995Z", "dateUpdated": "2026-02-03T15:31:00.835Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux", "x86", "64 bit", "ARM"], "product": "ADM", "vendor": "ASUSTOR", "versions": [{"lessThanOrEqual": "4.3.3.ROF1", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.1.1.RCI1", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Nuke"}], "datePublic": "2026-02-03T02:10:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address.<br><p>Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.</p>"}], "value": "The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1."}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "shortName": "ASUSTOR1", "dateUpdated": "2026-02-03T02:26:55.995Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.asustor.com/security/security_advisory_detail?id=50"}], "source": {"discovery": "UNKNOWN"}, "title": "An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T15:26:05.555286Z", "id": "CVE-2026-24934", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:31:00.835Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24934", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T15:26:05.555286Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:26:06.272Z"}}], "cna": {"title": "An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Nuke"}], "impacts": [{"capecId": "CAPEC-158", "descriptions": [{"lang": "en", "value": "CAPEC-158 Sniffing Network Traffic"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUSTOR", "product": "ADM", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.3.3.ROF1"}, {"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.1.1.RCI1"}], "platforms": ["Linux", "x86", "64 bit", "ARM"], "defaultStatus": "unaffected"}], "datePublic": "2026-02-03T02:10:00.000Z", "references": [{"url": "https://www.asustor.com/security/security_advisory_detail?id=50", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.", "supportingMedia": [{"type": "text/html", "value": "The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address.<br><p>Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "shortName": "ASUSTOR1", "dateUpdated": "2026-02-03T02:26:55.995Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24934", "state": "PUBLISHED", "dateUpdated": "2026-02-03T15:31:00.835Z", "dateReserved": "2026-01-28T08:40:24.461Z", "assignerOrgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "datePublished": "2026-02-03T02:26:55.995Z", "assignerShortName": "ASUSTOR1"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux", "x86", "64 bit", "ARM"], "product": "ADM", "vendor": "ASUSTOR", "versions": [{"lessThanOrEqual": "4.3.3.ROF1", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.1.1.RCI1", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "source": "security@asustor.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "matchCriteriaId": "662E4EA5-0C53-4669-947E-705E5E076B10", "versionEndIncluding": "4.3.3.rof1", "versionStartIncluding": "4.1.0.rhu2", "vulnerable": true}, {"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FC466AD-33C6-4F5C-A679-C5100B0B9B32", "versionEndExcluding": "5.1.2.re51", "versionStartIncluding": "5.0.0.ra82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1."}, {"lang": "es", "value": "La funci\u00f3n DDNS utiliza una conexi\u00f3n HTTP insegura o no valida el certificado SSL/TLS al consultar un servidor externo para la direcci\u00f3n IP WAN del dispositivo. Un atacante remoto no autenticado puede realizar un ataque man-in-the-middle (MitM) para falsificar la respuesta, lo que lleva al dispositivo a actualizar su registro DDNS con una direcci\u00f3n IP incorrecta.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.ROF1, as\u00ed como desde ADM 5.0.0 hasta ADM 5.1.1.RCI1."}], "id": "CVE-2026-24934", "lastModified": "2026-06-17T10:23:50.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@asustor.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24934", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T15:26:05.555286Z", "version": "2.0.3"}}]}, "published": "2026-02-03T03:15:53.383", "references": [{"source": "security@asustor.com", "tags": ["Vendor Advisory"], "url": "https://www.asustor.com/security/security_advisory_detail?id=50"}], "sourceIdentifier": "security@asustor.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@asustor.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:27:20.760963+00:00", "value": {"mitigation_remediation": ["Update ADM firmware to a fixed version as released by ASUSTOR.", "If an update is not immediately possible, disable the DDNS feature or reconfigure it to use a validated HTTPS endpoint that enforces strict certificate checks.", "Periodically review ADM logs for unexpected DDNS updates and verify that the recorded IP address matches the actual WAN IP address."], "summary": {"action": "Immediate Patch", "impact": "Man\u2011in\u2011the\u2011Middle spoofed DDNS IP"}, "threat_synthesis": {"affected_systems": "ASUSTOR Data Master Management (ADM) devices running firmware versions 4.1.0 through 4.3.3.ROF1, and 5.0.0 through 5.1.1.RCI1 are affected. The issue is present in the DDNS component of the ADM server software and applies to all devices within those version ranges.", "description_and_impact": "The vulnerability arises when the Dynamic DNS (DDNS) feature of the ASUSTOR ADM product uses an insecure HTTP connection or fails to perform proper SSL/TLS certificate validation while querying an external server for the device\u2019s WAN IP address. This flaw enables an unauthenticated attacker to mount a man\u2011in\u2011the\u2011middle attack, inject a rogue response, and cause the device to record an incorrect IP address in its DDNS record. The result is a broken or hijacked external address that can be used to redirect traffic, deny service, or compromise remote connections that rely on the DDNS entry. The weakness is a classic certificate\u2011validation failure, mapped to CWE\u2011295.", "risk_and_exploitability": "The CVSS base score is 6.3, indicating a moderate risk. The EPSS score of less than 1% shows that current exploitation likelihood is very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack does not require authentication and can be performed remotely by any entity that can reach the device\u2019s DDNS server, making the channel available for opportunistic exploitation. If an attacker succeeds, the wrong WAN IP can be propagated globally, affecting services that depend on reliable DDNS resolution."}}}}, "created": "2026-02-04T12:14:05.134467+00:00", "updated": "2026-04-18T00:30:25.715846+00:00", "vendors": ["asustor", "asustor$PRODUCT$adm"]}