SSL/TLS Certificate Validation Flaw in Asustor NAS Devices

CVE-2026-24935

What is CVE-2026-24935?

A vulnerability exists in the third-party NAT traversal module of Asustor NAS devices, which does not validate SSL/TLS certificates when establishing connections to the signaling server. While subsequent access to device functionalities requires further authentication, this flaw allows a Man-in-the-Middle (MitM) attacker to exploit the compromised NAT tunnel setup. As a result, the attacker could potentially compromise service availability or conduct further targeted attacks by positioning themselves as an intermediary between the user and the device services. This vulnerability affects specific versions of the ADM software on Asustor NAS devices, making it essential for users to update to secure versions and ensure their network is protected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References