CVE-2026-6644

critical

A command injection vulnerability was found in the PPTP VPN Clients on the ADM.

Vendor / product: Asustor — data master

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

CVSS

9.1

9.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-04-20 07:16

Modified: 2026-10-26 21:10

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

asustor / data_master ≥4.1.0.rhu2 <4.3.3.RR42, ≥5.0.0.ra82 <5.1.2.reo1

Weakness classification (CWE)

CWE-78

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://https://www.asustor.com/security/security_advisory_detail?id=55

References

https://https://www.asustor.com/security/security_advisory_detail?id=55 security@asustor.com
https://uky007.github.io/CVE-2026-6644/ 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-6643