CVE-2026-6644

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://https://www.asustor.com/security/security_advisory_detail?id=55	Broken Link Vendor Advisory
https://uky007.github.io/CVE-2026-6644/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:asustor:data_master::::::::
	cpe:2.3:o:asustor:data_master::::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos fue encontrada en los Clientes VPN PPTP en el ADM. La vulnerabilidad permite a un usuario administrativo salir del entorno web restringido y ejecutar código arbitrario en el sistema operativo subyacente. Esto ocurre debido a una validación insuficiente de la entrada proporcionada por el usuario antes de que sea pasada a un shell del sistema. La explotación exitosa permite a un atacante lograr Ejecución Remota de Código (RCE) y comprometer completamente el sistema. Los productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.RR42, así como desde ADM 5.0.0 hasta ADM 5.1.2.REO1.

Information

Published : 2026-04-20 07:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-6644

Mitre link : CVE-2026-6644

CVE.ORG link : CVE-2026-6644

JSON object : View

Products Affected

asustor

data_master

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-6644", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6644", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-30T12:47:20.401023Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security@asustor.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@asustor.com", "affectedData": [{"vendor": "ASUSTOR Inc.", "product": "ADM", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.3.3.RR42"}, {"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.1.2.REO1"}], "packageName": "PPTP VPN Clients", "defaultStatus": "unaffected"}]}], "published": "2026-04-20T07:16:16.693", "references": [{"url": "https://https://www.asustor.com/security/security_advisory_detail?id=55", "tags": ["Broken Link", "Vendor Advisory"], "source": "security@asustor.com"}, {"url": "https://uky007.github.io/CVE-2026-6644/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@asustor.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos fue encontrada en los Clientes VPN PPTP en el ADM. La vulnerabilidad permite a un usuario administrativo salir del entorno web restringido y ejecutar c\u00f3digo arbitrario en el sistema operativo subyacente. Esto ocurre debido a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario antes de que sea pasada a un shell del sistema. La explotaci\u00f3n exitosa permite a un atacante lograr Ejecuci\u00f3n Remota de C\u00f3digo (RCE) y comprometer completamente el sistema.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.RR42, as\u00ed como desde ADM 5.0.0 hasta ADM 5.1.2.REO1."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20307258-479E-4ECD-AF5E-B31019D22525", "versionEndExcluding": "4.3.3.RR42", "versionStartIncluding": "4.1.0.rhu2"}, {"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47B926F1-1D8F-4105-A533-45E0B4178C59", "versionEndExcluding": "5.1.2.reo1", "versionStartIncluding": "5.0.0.ra82"}], "operator": "OR"}]}], "sourceIdentifier": "security@asustor.com"}