CVE-2026-24935

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

• CWE-295

• https://www.asustor.com/security/security_advisory_detail?id=50Vendor Advisory

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2493IceWarp collaboration Directory Traversal Information Disclo…7.5
• CVE-2026-24930UAF concurrency vulnerability in the graphics module. Impact…5.5
• CVE-2026-24931Vulnerability of improper criterion security check in the ca…5.5
• CVE-2026-24932The DDNS update function in ADM fails to properly validate t…5.9
• CVE-2026-24933The API communication component fails to validate the SSL/TL…5.9
• CVE-2026-24934The DDNS function uses an insecure HTTP connection or fails …3.7
• CVE-2026-24936When a specific function is enabled while joining a AD Domai…9.8
• CVE-2026-24937Improper Control of Generation of Code ('Code Injection') vu…7.2
• CVE-2026-24938Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-24939Missing Authorization vulnerability in WP Chill Modula Image…4.3
• CVE-2026-2494The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2026-24940Missing Authorization vulnerability in Themefic Travelfic To…4.3