PT-2026-21876 · Asustor · Asustor Adm

Nuke · Publicado 2026-02-25 · Atualizado 2026-02-26 · CVE-2026-3100

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM versions 4.1.0 through 4.3.3.ROF1 ASUSTOR ADM versions 5.0.0 through 5.1.2.RE51

Description The FTP Backup feature does not properly validate TLS certificates when connecting to an FTP server using FTPES/FTPS. This improper validation allows a remote attacker to potentially intercept network traffic, enabling a Man-in-the-Middle (MitM) attack. Such an attack could lead to the interception, modification, or acquisition of sensitive information, including authentication credentials and backup data.

Recommendations Update ASUSTOR ADM to a version later than 5.1.2.RE51. Update ASUSTOR ADM to a version later than 4.3.3.ROF1.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-3100

Produtos afetados

Asustor Adm

Referências · 8

• https://asustor.com/security/security_advisory_detail?id=53 · Aviso do Fabricante
• https://t.me/cveNotify/153335 · Publicação no Telegram
• https://t.me/cveNotify/153110 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2026641334862324034 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3100 · Aviso do Fabricante
• https://t.me/cveNotify/153114 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3100 · Nota de Segurança
• https://t.me/CVEtracker/45700 · Publicação no Telegram