CVE-2026-24935
Description
A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
How to fix
- asustor data_master5.1.2.re51 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asustor data_master | 4.1.0.rhu2 ≤ v ≤ 4.3.3.rof1, 5.0.0.ra82 ≤ v < 5.1.2.re51 | 5.1.2.re51 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.