CVE-2026-6644: ASUSTOR ADM PPTP VPN Client OS Command Injection
An OS command injection flaw (CWE-78) in the PPTP VPN client of ASUSTOR ADM lets an administrative user escape the restricted web environment and run code on the underlying operating system. NVD scores it 9.1 (critical). The sources consulted show no confirmed exploitation in the wild, and the record lists no fixed versions.
Overview
The record describes an OS command injection flaw (CWE-78) in the PPTP VPN client component of ASUSTOR ADM. According to the description, user-supplied input is not validated sufficiently before it reaches a system shell.
Impact
- The description states that an administrative user can break out of the restricted web environment and run arbitrary code on the underlying operating system.
- The description characterizes successful exploitation as remote code execution with full system compromise.
- The NVD base score is 9.1 (critical). The CNA entry from ASUSTOR also appears in the record with a score of 9.4.
Affected products and versions
- ASUSTOR ADM: from 4.1.0 up to and including 4.3.3.RR42, and from 5.0.0 up to and including 5.1.2.REO1, as stated in the description.
- ASUSTOR Data Master: from 4.1.0.rhu2 up to but not including 4.3.3.RR42, and from 5.0.0.ra82 up to but not including 5.1.2.reo1, as listed in the affected data.
- The record lists no fixed versions.
Exploitation status
- CISA KEV does not list this CVE in the record, so no active exploitation in the wild is stated.
- The SSVC data in the record gives an exploitation value of poc (proof of concept) and marks the issue as not automatable.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify all ADM and Data Master systems within the affected ranges and check whether the PPTP VPN client feature is in use.
- Update to a release outside the affected ranges following the ASUSTOR vendor guidance. The record does not name a specific fixed build.
- Limit administrative accounts to trusted staff, enforce strong authentication, and restrict access to administrative interfaces to trusted networks.
- Review administrative account activity for unexpected changes until the system is patched.
Detection guidance
- Review web and system logs of the ADM for unusual administrative requests to VPN configuration functions and for unexpected child processes started by the web service.
- Monitor for new or modified VPN configuration entries and for unexpected outbound connections from the device.
Limitations of the available information
- The record gives no fixed versions, and the ADM and Data Master ranges use different inclusive and exclusive endpoints.
- The vendor advisory is not among the sources provided. The only reference is a third-party write-up.
- The NVD score of 9.1 and the CNA score of 9.4 differ, and the record does not explain the difference.
- Public exploit details beyond the SSVC exploitation value are not described in the sources.
Frequently asked questions
What is the vulnerability in CVE-2026-6644?
It is an OS command injection flaw (CWE-78) in the PPTP VPN client of ASUSTOR ADM. Insufficient input validation lets an administrative user run code on the underlying operating system.
Is this CVE being actively exploited?
CISA KEV does not list it in the record, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data indicates a proof-of-concept exploitation level.
Which versions are affected?
The description lists ADM from 4.1.0 up to and including 4.3.3.RR42, and from 5.0.0 up to and including 5.1.2.REO1. The Data Master ranges use exclusive upper bounds at 4.3.3.RR42 and 5.1.2.reo1.
Is a fixed version available?
The record does not list any fixed versions. Check the ASUSTOR vendor guidance for an updated release outside the affected ranges.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.