Technical impact
A third‑party NAT traversal module in ASUSTOR ADM devices fails to validate SSL/TLS certificates when connecting to the signaling server. An attacker who can position themselves between the device and the server can intercept, alter, or redirect the NAT tunnel establishment. The attacker cannot immediately reach device services, but by acting as a transparent proxy they can disrupt service availability or later launch more targeted attacks against the device’s internal services. This weakness is a classic certificate‑validation flaw that permits a MITM attack and carries the potential to compromise integrity and availability of the managed storage system.
Affected Systems
ASUSTOR ADM firmware versions from 4.1.0 through 4.3.3.ROF1 and from 5.0.0 through 5.1.1.RCI1 are impacted.
Risk and Exploitability
The CVSS score of 6.3 indicates moderate risk. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker able to insert themselves into the network path between the device and the official signaling server; this does not require local device compromise but does require control over the network or a compromised endpoint. Once positioned, the attacker could intercept the NAT traversal handshake, causing a denial of service or providing a foothold for further exploitation.
