ASUSTOR ADM CVE-2025-13052

Exploitation is gated by a specific, non-default configuration: the administrator must have set up ADM's Notification sender to send emails to an external SMTP server via msmtp. Given that, the limiting factor is positional - the attacker must already be able to intercept and manipulate traffic between the NAS SMTP client and the SMTP server (an active man-in-the-middle on the LAN or upstream path), which the CVSS 4.0 AT:P metric reflects. There is no authentication requirement against the NAS itself (PR:N) and no user interaction, but if notification email is never configured, or the SMTP path cannot be intercepted, the vulnerability is not reachable.

This is a genuine-but-conditional confidentiality flaw rather than a drop-everything priority. The signals are internally consistent and all point low-to-moderate: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) is the key nuance: although PR:N means no credentials are needed on the target, the AT:P (attack requirements present) metric encodes the real gating factor - the attacker must already occupy a man-in-the-middle position on the network path between the ASUSTOR NAS and its SMTP server. That is not a widespread, internet-wide spray condition, which is why the low EPSS is coherent with the 7.0 CVSS rather than contradicting it. The vendor-supplied 4.0 vector places the heavier impact on subsequent systems (SC:H/SI:H) - i.e., the SMTP account and mail infrastructure whose credentials leak - while the vulnerable NAS itself takes only limited confidentiality impact (VC:L). Bottom line: real but situational; prioritize for environments where NAS notification email is configured and where an attacker could plausibly sit on the SMTP path (shared LAN, untrusted segment, or cleartext-capable upstream).

An administrator configures ADM's Notification sender to send alert emails through an external SMTP server via msmtp. Because msmtp does not properly validate the server's TLS/SSL certificate, an attacker positioned on the network path presents a forged certificate, which the client accepts, allowing the attacker to decrypt and capture the SMTP session - including the account credentials and email contents. No public exploit code was identified at time of analysis, and success requires the attacker to already hold a man-in-the-middle position.