The ADM API communication component ignores SSL/TLS certificate validation when establishing HTTPS connections to the server. Consequently, an unauthenticated remote attacker can mount a Man‑in‑The‑Middle attack and intercept clear‑text data sent over HTTPS, potentially exposing account e‑mail addresses, MD5‑hashed passwords, and device serial numbers.

ASUSTOR ADM software versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.1.RCI1 are affected. Devices running any of these releases are susceptible until the flaw is patched or mitigated.

The vulnerability carries a CVSS score of 8.9 (High). The EPSS indicates a probability of exploitation below 1 %, and it is not listed in the CISA KEV catalog. Inferred: an attacker would need to supply a forged or otherwise modified SSL/TLS certificate to the device during its outbound HTTPS transaction; the device then accepts it without verification. This can be staged from any external network location, with no authentication required. Because the flaw allows complete interception of application traffic, it enables data exfiltration and credential theft.