CVE-2026-24932 An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.

High 8.9 Published 3 Feb 2026 Updated 3 Feb 2026

Improper certificate validation in ADM DDNS allows Man-in-the-Middle attacks to intercept sensitive user credentials and device information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24932?

CVE-2026-24932 is a high-severity vulnerability in ASUSTOR ADM, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email, MD5 hashed password, and device serial number.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.1.RCI1.

Weakness: CWE-295

Which versions are affected by CVE-2026-24932?

It affects 1 product.

Products include Asustor Data Master.

How do I fix CVE-2026-24932?

No fix has been published for CVE-2026-24932 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-24932 being exploited?

There is no known exploitation of CVE-2026-24932 in the wild and no public exploit code.

Sources

Also known as GHSA-78vp-42ph-7f4v.