CVE-2026-6644

A command injection vulnerability was found in the PPTP VPN Clients on the ADM

State: Published
Severity: 9.4 Critical
Published: Apr 20, 2026
Updated: Apr 30, 2026
Reserved: Apr 20, 2026

Description

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	ASUSTOR1

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
ADMASUSTOR Inc.	4.1.0 through 4.3.3.RR42Affected 5.0.0 through 5.1.2.REO1Affected

References

https://https//www.asustor.com/security/security_advisory_detail?id=55vendor-advisory
https://uky007.github.io/CVE-2026-6644/exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.