Asustor ADM Third-Party NAT Traversal Module SSL/TLS Certificate Validation Vulnerability

A vulnerability exists in a third-party NAT traversal module within Asustor's ADM operating system, specifically in versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.1.RCI1. The module fails to properly validate SSL/TLS certificates when connecting to the signaling server. This oversight allows a Man-in-the-Middle (MitM) attacker to intercept or redirect the establishment of NAT tunnels. While accessing device services afterward requires additional authentication, this vulnerability could enable an attacker to disrupt service availability or conduct further targeted attacks by proxying between the user and the device services.

Impact

Exploitation of this vulnerability could lead to intercepted communications, allowing an attacker to disrupt services or facilitate targeted attacks by acting as a proxy between the user and device services.

Remediation

Users can update to Asustor ADM version 5.1.2.RE31, which addresses this vulnerability.