CVE-2026-6644: A command injection vulnerability was found in the PPTP VPN Clients on the ADM
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6644?
CVE-2026-6644 is rated as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-6644?
To fix CVE-2026-6644, update your ASUSTOR ADM software to version 4.3.3.RR43 or later, or 5.1.2.REO2 or later.
Who is affected by CVE-2026-6644?
CVE-2026-6644 affects ASUSTOR ADM versions from 4.1.0 to 4.3.3.RR42 and 5.0.0 to 5.1.2.REO1.
What types of attacks can CVE-2026-6644 enable?
CVE-2026-6644 can enable remote attackers to execute arbitrary commands on the affected system.
Is CVE-2026-6644 related to specific software or protocol?
CVE-2026-6644 is specifically related to the PPTP VPN Clients in ASUSTOR ADM software.