An improper validation of TLS/SSL certificates in the FTP Backup feature of the ADM allows an attacker to perform a Man‑in‑the‑Middle attack while the system is backing up to an FTPES/FTPS server. The flaw permits interception, alteration, or retrieval of sensitive data such as authentication credentials and backup contents without the user’s knowledge. This weakness corresponds to CWE‑295, which focuses on lack of proper authentication of certificates, leading to potential data compromise.

The issue affects devices running ASUSTOR ADM firmware versions from 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.2.RE51.

The CVSS score of 8.3 indicates high severity; the EPSS score of less than 1% suggests a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs the ability to establish an FTPES/FTPS connection to the ADM; no local privileges or additional credentials are required. Given the high severity, the potential impact on confidentiality and integrity of backup data is significant if the flaw is exploited.