Vulnerability details
CVE-2026-6644
ASUSTOR ADM
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
CVSS 4.0
9.4Critical
Official description
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (ASUSTOR1) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| ASUSTOR Inc. | ADM | 4.1.0 ≤ v ≤ 4.3.3.RR42 | CVEProject cvelistV5 (CNA) |
| ASUSTOR Inc. | ADM | 5.0.0 ≤ v ≤ 5.1.2.REO1 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-20
- Last updated
- 2026-04-30
- State
- Published
- Assigner (CNA)
- ASUSTOR1
Exploit prediction (EPSS)
1.94%
Probability of exploitation in 30 days
80.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')