ASUSTOR ADM CVE-2025-13053

Exploitation requires that the NAS be explicitly configured to retrieve UPS status or control a UPS over the network (network UPS mode), so default installations without this UPS integration are not affected. Additionally, the attacker must hold a man-in-the-middle / on-path position on the network segment between the NAS client and the UPS server (reflected as AT:P in the CVSS 4.0 vector), because the flaw is non-enforced TLS certificate verification (CWE-311) rather than a directly reachable service. Limiting factors: the UPS feature must be enabled, the attacker must already intercept the traffic, and only ADM versions 4.1.0 through 4.3.3.RKD2 and 5.0.0 through 5.1.0.RN42 are in scope; impact is disclosure of UPS server configuration rather than full device compromise.

This is a moderate-severity information-disclosure weakness (CVSS 4.0 base 7.0) in ASUSTOR ADM, and the signals converge on LOW real-world urgency despite the 'High' label. The provided CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N - note AT:P, meaning a specific attack requirement exists: the attacker must already be positioned to intercept traffic (on-path/MITM), which is a meaningful barrier even though the vector is 'network.' EPSS is only 0.10% (1st percentile), indicating essentially no observed or predicted mass exploitation. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' These signals agree: a MITM-dependent config-disclosure flaw in a consumer/SMB NAS OS is not a drive-by, wormable, or widely-weaponized issue. One point of tension worth flagging: the vendor's CVSS 4.0 vector rates subsequent-system impact high (SC:H/SI:H) while the description frames the issue purely as disclosure of UPS server configuration information - the subsequent integrity rating appears aggressive relative to the described impact; verify actual integrity/control consequences with the vendor advisory. Net: patch during normal maintenance cycles; this is not an emergency.

On a LAN where an ASUSTOR NAS is configured to poll or control a network UPS, an attacker who can intercept traffic between the NAS and the UPS server (e.g., via ARP spoofing or a rogue gateway) presents a forged TLS certificate that the NAS fails to validate. The attacker then decrypts the session and captures sensitive UPS server configuration data. No public exploit code is referenced, and success requires the attacker to first achieve an on-path man-in-the-middle position.