CVE-2026-3100 - An improper certificate validation vulnerability was found in the FTP Backup on the ADM.

Back Back to CVE browser

HIGH

An improper certificate validation vulnerability was found in the FTP Backup on the ADM.

Published Feb 25, 2026

8.3

HIGH

CVSS 4.0

EPSS 0.27%

Description

The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

Affected products

Vendor Asustor Product ADM Default
unaffected
- Version
  4.1.0
  Status
  affected
  Constraints
  <=4.3.3.ROF1
- Version
  5.0.0
  Status
  affected
  Constraints
  <=5.1.2.RE51

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Asustor

ADM

unaffected

Version	Status	Constraints
4.1.0	affected	<=4.3.3.ROF1
5.0.0	affected	<=5.1.2.RE51

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8516
Advisory
https://www.asustor.com/security/security_advisory_detail?id=53
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8516		Advisory
https://www.asustor.com/security/security_advisory_detail?id=53		vendor-advisoryVendor Advisory