CVE-2026-24935 An improper certificate validation vulnerability was found in a third-party NAT traversal module.

Medium 6.3 Published 3 Feb 2026 Updated 3 Feb 2026

Attackers can intercept NAT tunnel connections due to missing certificate validation, enabling service disruption or proxy-based attacks on ASUSTOR NAS devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24935?

CVE-2026-24935 is a medium-severity vulnerability in ASUSTOR ADM, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Weakness: CWE-295

Which versions are affected by CVE-2026-24935?

It affects 1 product.

Products include Asustor Data Master.

How do I fix CVE-2026-24935?

No fix has been published for CVE-2026-24935 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-24935 being exploited?

There is no known exploitation of CVE-2026-24935 in the wild and no public exploit code.

Sources

Also known as GHSA-mmqq-p5mv-jc88.