CVE-2026-24934: ADM DDNS Information Disclosure Flaw

CVE-2026-24934 Overview

CVE-2026-24934 is an Improper Certificate Validation vulnerability affecting ASUSTOR ADM (ASUSTOR Data Master) NAS operating system. The vulnerability exists in the Dynamic DNS (DDNS) functionality, which uses an insecure HTTP connection or fails to properly validate SSL/TLS certificates when querying external servers for the device's WAN IP address. This security flaw allows an unauthenticated remote attacker to perform Man-in-the-Middle (MitM) attacks to spoof responses, ultimately causing the device to update its DDNS record with an incorrect IP address.

Critical Impact
Successful exploitation enables attackers to redirect traffic intended for the NAS device to attacker-controlled infrastructure by manipulating DDNS records through MitM attacks, potentially leading to data interception, phishing, or service disruption.

Affected Products

ASUSTOR ADM 4.1.0 through ADM 4.3.3.ROF1
ASUSTOR ADM 5.0.0 through ADM 5.1.1.RCI1

Discovery Timeline

2026-02-03 - CVE-2026-24934 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-24934

Vulnerability Analysis

This vulnerability stems from improper certificate validation (CWE-295) in the DDNS feature of ASUSTOR ADM. When the NAS device needs to determine its public WAN IP address for DDNS updates, it queries an external server. The implementation either uses an insecure HTTP connection instead of HTTPS, or when HTTPS is used, it fails to properly validate the SSL/TLS certificate presented by the server. This allows an attacker positioned between the NAS device and the external IP lookup service to intercept and modify the response.

The attack requires network positioning that enables traffic interception, which can be achieved through ARP spoofing, DNS hijacking, or compromising network infrastructure between the NAS and the external service. Once positioned, the attacker can return a spoofed IP address, causing the NAS to update its DDNS record to point to an attacker-controlled server.

Root Cause

The root cause is improper implementation of secure communications in the DDNS module. Specifically, the vulnerability is classified under CWE-295 (Improper Certificate Validation), indicating that the code either bypasses certificate verification, accepts self-signed certificates without validation, or uses plain HTTP for sensitive operations that should require authenticated and encrypted channels. This design flaw allows attackers to present fraudulent certificates or intercept unencrypted traffic without detection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker capable of performing a Man-in-the-Middle attack on the network path between the ASUSTOR NAS device and the external IP lookup service can exploit this vulnerability. The attack flow involves:

Positioning on the network to intercept traffic from the target NAS device
Intercepting the outgoing request to the external IP lookup service
Responding with a spoofed IP address instead of the legitimate response
The NAS device accepts the spoofed response and updates its DDNS record
All traffic intended for the NAS is now redirected to the attacker's specified IP

The vulnerability mechanism involves the DDNS client making HTTP requests or improperly validated HTTPS requests to external services. When the device sends a request to determine its public IP, an attacker in a MitM position can intercept this request and return a malicious response containing an attacker-controlled IP address. See the Asustor Security Advisory #50 for additional technical details.

Detection Methods for CVE-2026-24934

Indicators of Compromise

Unexpected changes to DDNS records pointing to unfamiliar IP addresses
Outbound HTTP traffic from NAS devices to IP lookup services that should use HTTPS
SSL/TLS certificate warnings or errors in network logs related to DDNS operations
Traffic from NAS devices being routed through unexpected network paths

Detection Strategies

Monitor DDNS record changes for your ASUSTOR NAS devices and alert on unexpected modifications
Implement network monitoring to detect potential ARP spoofing or MitM attacks on segments containing NAS devices
Review ADM version numbers across all ASUSTOR devices to identify vulnerable installations
Deploy network intrusion detection rules to identify unencrypted traffic to common IP lookup services

Monitoring Recommendations

Enable comprehensive logging on ASUSTOR ADM devices and centralize logs for analysis
Monitor network traffic patterns for anomalies in DDNS-related communications
Implement DNS monitoring to detect unauthorized changes to DDNS-managed hostnames
Configure alerts for any configuration changes on NAS devices, particularly network-related settings

How to Mitigate CVE-2026-24934

Immediate Actions Required

Update ASUSTOR ADM to the latest patched version as specified in the vendor advisory
Audit current DDNS records to verify they point to legitimate IP addresses
Consider temporarily disabling DDNS functionality until patches are applied
Implement network segmentation to isolate NAS devices from potentially compromised network segments

Patch Information

ASUSTOR has released security updates to address this vulnerability. Administrators should refer to Asustor Security Advisory #50 for specific patch versions and update instructions. Users running ADM versions 4.1.0 through 4.3.3.ROF1 or 5.0.0 through 5.1.1.RCI1 should prioritize updating to patched releases.

Workarounds

Disable the DDNS feature if not required for business operations
Use a VPN or secure tunnel to access NAS devices instead of relying on DDNS
Manually configure static DNS entries as an alternative to dynamic updates
Implement network-level protections such as 802.1X authentication to reduce MitM attack surface

If DDNS functionality is required before patching, consider implementing additional network monitoring and access controls. Ensure network infrastructure uses secure protocols and proper certificate validation to minimize the risk of MitM attacks on the network path between the NAS and external services.