CVE-2026-24934: ADM DDNS Information Disclosure Flaw

CVE-2026-24934 Overview

CVE-2026-24934 is an Improper Certificate Validation vulnerability affecting ASUSTOR ADM (ASUSTOR Data Master) NAS operating system. The vulnerability exists in the Dynamic DNS (DDNS) functionality, which uses an insecure HTTP connection or fails to properly validate SSL/TLS certificates when querying external servers for the device's WAN IP address. This security flaw allows an unauthenticated remote attacker to perform Man-in-the-Middle (MitM) attacks to spoof responses, ultimately causing the device to update its DDNS record with an incorrect IP address.

Critical Impact

Successful exploitation enables attackers to redirect traffic intended for the NAS device to attacker-controlled infrastructure by manipulating DDNS records through MitM attacks, potentially leading to data interception, phishing, or service disruption.

Affected Products

• ASUSTOR ADM 4.1.0 through ADM 4.3.3.ROF1
• ASUSTOR ADM 5.0.0 through ADM 5.1.1.RCI1

Discovery Timeline

• 2026-02-03 - CVE-2026-24934 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-24934

Vulnerability Analysis

This vulnerability stems from improper certificate validation (CWE-295) in the DDNS feature of ASUSTOR ADM. When the NAS device needs to determine its public WAN IP address for DDNS updates, it queries an external server. The implementation either uses an insecure HTTP connection instead of HTTPS, or when HTTPS is used, it fails to properly validate the SSL/TLS certificate presented by the server. This allows an attacker positioned between the NAS device and the external IP lookup service to intercept and modify the response.

The attack requires network positioning that enables traffic interception, which can be achieved through ARP spoofing, DNS hijacking, or compromising network infrastructure between the NAS and the external service. Once positioned, the attacker can return a spoofed IP address, causing the NAS to update its DDNS record to point to an attacker-controlled server.

Root Cause

The root cause is improper implementation of secure communications in the DDNS module. Specifically, the vulnerability is classified under CWE-295 (Improper Certificate Validation), indicating that the code either bypasses certificate verification, accepts self-signed certificates without validation, or uses plain HTTP for sensitive operations that should require authenticated and encrypted channels. This design flaw allows attackers to present fraudulent certificates or intercept unencrypted traffic without detection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker capable of performing a Man-in-the-Middle attack on the network path between the ASUSTOR NAS device and the external IP lookup service can exploit this vulnerability. The attack flow involves:

1. Positioning on the network to intercept traffic from the target NAS device
2. Intercepting the outgoing request to the external IP lookup service
3. Responding with a spoofed IP address instead of the legitimate response
4. The NAS device accepts the spoofed response and updates its DDNS record
5. All traffic intended for the NAS is now redirected to the attacker's specified IP

The vulnerability mechanism involves the DDNS client making HTTP requests or improperly validated HTTPS requests to external services. When the device sends a request to determine its public IP, an attacker in a MitM position can intercept this request and return a malicious response containing an attacker-controlled IP address. See the Asustor Security Advisory #50 for additional technical details.

Detection Methods for CVE-2026-24934

Indicators of Compromise

• Unexpected changes to DDNS records pointing to unfamiliar IP addresses
• Outbound HTTP traffic from NAS devices to IP lookup services that should use HTTPS
• SSL/TLS certificate warnings or errors in network logs related to DDNS operations
• Traffic from NAS devices being routed through unexpected network paths

Detection Strategies

• Monitor DDNS record changes for your ASUSTOR NAS devices and alert on unexpected modifications
• Implement network monitoring to detect potential ARP spoofing or MitM attacks on segments containing NAS devices
• Review ADM version numbers across all ASUSTOR devices to identify vulnerable installations
• Deploy network intrusion detection rules to identify unencrypted traffic to common IP lookup services

Monitoring Recommendations

• Enable comprehensive logging on ASUSTOR ADM devices and centralize logs for analysis
• Monitor network traffic patterns for anomalies in DDNS-related communications
• Implement DNS monitoring to detect unauthorized changes to DDNS-managed hostnames
• Configure alerts for any configuration changes on NAS devices, particularly network-related settings

How to Mitigate CVE-2026-24934

Immediate Actions Required

• Update ASUSTOR ADM to the latest patched version as specified in the vendor advisory
• Audit current DDNS records to verify they point to legitimate IP addresses
• Consider temporarily disabling DDNS functionality until patches are applied
• Implement network segmentation to isolate NAS devices from potentially compromised network segments

Patch Information

ASUSTOR has released security updates to address this vulnerability. Administrators should refer to Asustor Security Advisory #50 for specific patch versions and update instructions. Users running ADM versions 4.1.0 through 4.3.3.ROF1 or 5.0.0 through 5.1.1.RCI1 should prioritize updating to patched releases.

Workarounds

• Disable the DDNS feature if not required for business operations
• Use a VPN or secure tunnel to access NAS devices instead of relying on DDNS
• Manually configure static DNS entries as an alternative to dynamic updates
• Implement network-level protections such as 802.1X authentication to reduce MitM attack surface

If DDNS functionality is required before patching, consider implementing additional network monitoring and access controls. Ensure network infrastructure uses secure protocols and proper certificate validation to minimize the risk of MitM attacks on the network path between the NAS and external services.