CVE-2026-6643: A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6643?
CVE-2026-6643 has a high severity due to its potential to cause stack-based buffer overflow exploitation.
How do I fix CVE-2026-6643?
To fix CVE-2026-6643, update the ASUSTOR ADM software to a version that addresses the vulnerability.
Which versions of ASUSTOR ADM are affected by CVE-2026-6643?
CVE-2026-6643 affects ASUSTOR ADM versions from 4.1.0 to 4.3.3.RR42 and from 5.0.0 to 5.1.2.REO1.
What type of vulnerability is CVE-2026-6643?
CVE-2026-6643 is a stack-based buffer overflow vulnerability found in the VPN Clients on the ASUSTOR ADM platform.
What are the potential consequences of CVE-2026-6643?
The exploitation of CVE-2026-6643 could lead to remote code execution, which poses a significant security risk.