CVE-2026-3100

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3100
The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.asustor.com/security/security_advisory_detail?id=53 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*
cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:43

Type Values Removed Values Added
Summary
  • (es) La copia de seguridad FTP en el ADM no aplicará de forma adecuada y estricta la verificación de certificados TLS al conectarse a un servidor FTP utilizando FTPES/FTPS. Unos certificados TLS/SSL validados incorrectamente permiten que un atacante remoto intercepte el tráfico de red para realizar un ataque Man-in-the-Middle (MitM), que puede interceptar, modificar u obtener información sensible como credenciales de autenticación y datos de copia de seguridad. Los productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.ROF1, así como desde ADM 5.0.0 hasta ADM 5.1.2.RE51.

26 Feb 2026, 16:33

Type Values Removed Values Added
References () https://www.asustor.com/security/security_advisory_detail?id=53 - () https://www.asustor.com/security/security_advisory_detail?id=53 - Vendor Advisory
CPE cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Asustor data Master
Asustor

25 Feb 2026, 07:16

Type Values Removed Values Added
Summary (en) Improper Certificate Validation vulnerability in ASUSTOR ADM FTP Backup on Linux, x86, ARM, 64 bit allows Sniffing Attacks.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.2.RE51. (en) The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

25 Feb 2026, 06:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 06:16

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3100

Mitre link : CVE-2026-3100

CVE.ORG link : CVE-2026-3100

JSON object : View

Products Affected

asustor

  • data_master
CWE
CWE-295

Improper Certificate Validation