The vulnerability arises when the Dynamic DNS (DDNS) feature of the ASUSTOR ADM product uses an insecure HTTP connection or fails to perform proper SSL/TLS certificate validation while querying an external server for the device’s WAN IP address. This flaw enables an unauthenticated attacker to mount a man‑in‑the‑middle attack, inject a rogue response, and cause the device to record an incorrect IP address in its DDNS record. The result is a broken or hijacked external address that can be used to redirect traffic, deny service, or compromise remote connections that rely on the DDNS entry. The weakness is a classic certificate‑validation failure, mapped to CWE‑295.

ASUSTOR Data Master Management (ADM) devices running firmware versions 4.1.0 through 4.3.3.ROF1, and 5.0.0 through 5.1.1.RCI1 are affected. The issue is present in the DDNS component of the ADM server software and applies to all devices within those version ranges.

The CVSS base score is 6.3, indicating a moderate risk. The EPSS score of less than 1% shows that current exploitation likelihood is very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack does not require authentication and can be performed remotely by any entity that can reach the device’s DDNS server, making the channel available for opportunistic exploitation. If an attacker succeeds, the wrong WAN IP can be propagated globally, affecting services that depend on reliable DDNS resolution.