Medium severity · published Feb 3, 2026
CVE-2026-24933
An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnerability allows an unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to intercept the cleartext communication, potentially leading to the exposure of sensitive user information, including account emails, MD5 hashed passwords, and device serial numbers.
Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
ADM · ASUSTOR
4.1.0 through 4.3.3.ROF1; 5.0.0 through 5.1.1.RCI1 · source: vendor
DM
Data Master · Asustor
4.1.0.rhu2 through 4.3.3.rof1; 5.0.0.ra82 before 5.1.2.re51 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24933
Vendor Advisory
https://www.asustor.com/security/security_advisory_detail?id=50
More from ADM
10.0
CVE-2023-2909
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files
9.8
CVE-2026-24936
An improper input validation vulnerability was found in ADM while joining a AD Domain.
9.8
CVE-2023-30770
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation
9.8
CVE-2018-11510
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the…
8.8
CVE-2022-37398
A stack-based buffer overflow vulnerability was found on ADM