CVE-2026-6643

CVE-2026-6643 is a critical stack-based buffer overflow vulnerability affecting QNAP ADM (Advanced Device Management) versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1. The flaw exists in VPN Client functionality and results from improper use of unbounded sscanf() and printf() functions processing user-controlled input. An authenticated remote attacker can exploit this vulnerability to execute arbitrary code with web server privileges due to absent PIE and stack canary protections. The vulnerability carries a CVSS score of 9.9 (Critical) with a network attack vector, low complexity, and low privilege requirements, enabling remote exploitation without user interaction. The impact is severe, providing complete compromise of confidentiality, integrity, and availability across the system boundary. Despite the critical rating, the EPSS score of 0.00119 indicates relatively low prevalence among actively exploited vulnerabilities in the wild. Currently, there is no evidence of active exploitation in public records. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and shows no inclusion on active threat hotlists, suggesting minimal real-world weaponization at this time. Organizations running affected ADM versions should prioritize patching to prevent potential future exploitation by authenticated attackers with network access.