CVE-2026-24932 — An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.

CVE-2026-24932

An improper certificate validation vulnerability was found in ADM while updating the DDNS settings. PUBLISHED

Description (CNA)

The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email, MD5 hashed password, and device serial number.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.1.RCI1.

Affected (CNA)

Vendor / product	Versions
ASUSTOR / ADM	affected 4.1.0 through 4.3.3.ROF1; affected 5.0.0 through 5.1.1.RCI1

CWE

CWE-295

References

https://www.asustor.com/security/security_advisory_detail?id=50

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.