CVE-2026-3100

Medium

Description

The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

SeverityMedium

CVSS6.5

Exploit probability—

ProductAsustor Data Master

PublishedFeb 25, 2026

First seenFeb 25, 2026

Weakness typeCWE-295CWE-295

How to fix

Update

asustor data_master5.1.2.reo1 or later

Vendor advisories

asustor.com/security/security_advisory_detail?id=53

Affected products

Product	Affected versions	Fixed in
asustor data_master	4.1.0.rhu2 ≤ v ≤ 4.3.3.rof1, 5.0.0.ra82 ≤ v < 5.1.2.reo1	5.1.2.reo1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.