CVE-2026-6644 json
A command injection vulnerability was found in the PPTP VPN Clients on the ADM
published 2026-04-20 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-23784
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.
Patch / fix
- asustor data_master 4.3.3.RR42, 5.1.2.reo1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- uky007.github.io https://uky007.github.io/CVE-2026-6644/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
- ASUSTOR Inc. ADM
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
uky007.github.io
/CVE-2026-6644/
exploit
-
https
//www.asustor.com/security/security_advisory_detail?id=55
vendor-advisory, broken-link
Sources
- CVE List CVE-2026-6644
- NVD CVE-2026-6644
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.