ASUSTOR ADM up to 4.3.3.ROF1/5.1.2.RE51 FTP Backup certificate validation

Summaryinfo

A vulnerability labeled as critical has been found in ASUSTOR ADM up to 4.3.3.ROF1/5.1.2.RE51. Affected by this issue is some unknown functionality of the component FTP Backup. The manipulation results in certificate validation. This vulnerability is known as CVE-2026-3100. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ASUSTOR ADM up to 4.3.3.ROF1/5.1.2.RE51. Affected is an unknown part of the component FTP Backup. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. CVE summarizes:

The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

The weakness was published by Nuke. The advisory is shared for download at asustor.com. This vulnerability is traded as CVE-2026-3100 since 02/24/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/25/2026). The MITRE ATT&CK project declares the attack technique as T1587.003.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-8516). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ASUSTOR

Name

• ADM

Version

• 4.3.3.ROF1
• 5.1.2.RE51

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion