PT-2026-5764 · Adm · Adm

Nuke · CVE-2026-24932 · Published 2026-02-03 · Updated 2026-02-19

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.ROF1 ADM versions 5.0.0 through 5.1.1.RCI1

Description The DDNS update function does not properly validate the hostname of the DDNS server’s TLS/SSL certificate. Despite using HTTPS, improper validation allows a remote attacker to intercept communication, potentially performing a Man-in-the-Middle (MitM) attack. This could lead to the compromise of sensitive information during the DDNS updating process, including the user’s account email, MD5 hashed password, and device serial number.

Recommendations Update ADM to a version later than 4.3.3.ROF1 Update ADM to a version later than 5.1.1.RCI1

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-24932

Affected Products

Adm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-24932 · Security Note
• https://asustor.com/security/security_advisory_detail?id=50 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24932 · Vendor Advisory
• https://t.me/CVEtracker/43558 · Telegram Post
• https://twitter.com/CVEnew/status/2018534809237131770 · Twitter Post
• https://t.me/cveNotify/150675 · Telegram Post
• https://t.me/cveNotify/152482 · Telegram Post