ADM Certificate Validation Vulnerabilities (CVE-2026-24932/33/34/35) Advisory

Key Information Announcement ID: AS-2026-001: ADM Release Date: 2026-02-03 Severity: Important Status: Ongoing Vulnerability Statement Multiple certificate validation vulnerabilities affect ADM: - During DDNS settings update - When sending HTTPS requests to servers - When querying external servers to retrieve device WAN IP address - In third-party NAT traversal module Affected Products Product Versions: ADM 4.1.0 to ADM 4.3.3.ROF1 and ADM 5.0.0 to ADM 5.1.1.RCI1 Vulnerability Details CVE-2026-24932 - Severity: High - CVSS4 Base Score: 8.9 - CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - Issue: During DDNS update, the TLS/SSL certificate of the DDNS server is not properly validated, potentially enabling man-in-the-middle (MitM) attacks. CVE-2026-24933 - Severity: High - CVSS4 Base Score: 8.9 - CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - Issue: The API communication component fails to validate the SSL/TLS certificate of the server, which may lead to MitM attacks. CVE-2026-24934 - Severity: Medium - CVSS4 Base Score: 6.3 - CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - Issue: The DDNS feature uses insecure HTTP connections, potentially causing the device to update DDNS records with incorrect IP addresses. CVE-2026-24935 - Severity: Medium - CVSS4 Base Score: 6.3 - CVSS4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Issue: The third-party NAT traversal module does not validate the SSL/TLS certificate on the signing server, potentially allowing MitM attacks that could impact service availability or facilitate further attacks. Fix Information Fixed Version: ADM 5.1.2.RE31

Goal Reached Thanks to every supporter — we hit 100%!

ADM Certificate Validation Vulnerabilities (CVE-2026-24932/33/34/35) Advisory