PT-2026-5764 · Adm · Adm

Nuke · Publicado 2026-02-03 · Atualizado 2026-02-19 · CVE-2026-24932

Positive Technologies (AI Summary)

CVSS v4.0

8.9

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.ROF1 ADM versions 5.0.0 through 5.1.1.RCI1

Description The DDNS update function does not properly validate the hostname of the DDNS server’s TLS/SSL certificate. Despite using HTTPS, improper validation allows a remote attacker to intercept communication, potentially performing a Man-in-the-Middle (MitM) attack. This could lead to the compromise of sensitive information during the DDNS updating process, including the user’s account email, MD5 hashed password, and device serial number.

Recommendations Update ADM to a version later than 4.3.3.ROF1 Update ADM to a version later than 5.1.1.RCI1

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-24932

Produtos afetados

Adm

Referências · 7

• https://t.me/CVEtracker/43558 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24932 · Nota de Segurança
• https://twitter.com/CVEnew/status/2018534809237131770 · Publicação no Twitter
• https://t.me/cveNotify/150675 · Publicação no Telegram
• https://asustor.com/security/security_advisory_detail?id=50 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-24932 · Aviso do Fabricante
• https://t.me/cveNotify/152482 · Publicação no Telegram