CVE-2026-6644 is a command injection vulnerability in PPTP VPN Clients on Asustor Data Master (ADM) devices that allows authenticated administrative users to execute arbitrary code on the underlying operating system due to insufficient input validation. The vulnerability affects ADM versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1. Successful exploitation grants complete system compromise through Remote Code Execution (RCE). The vulnerability carries a critical CVSS score of 9.1 with a network attack vector, low complexity, and high privileges requirement. It impacts confidentiality, integrity, and availability across system boundaries. The EPSS score of 0.00225 indicates this threat is currently lower priority relative to other disclosed vulnerabilities in the broader threat landscape. There is no evidence of active exploitation at this time, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on industry hot lists. No public exploit code is currently available, suggesting limited community attention. Organizations managing affected ADM versions should prioritize patching as a medium-term security control measure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.1.0.rhu2, < 4.3.3.RR42CPE matchmatch criteria | cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:* | ||
>= 5.0.0.ra82, < 5.1.2.reo1CPE matchmatch criteria | cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.7 Bluesky, 0.4 Mastodon, and 1.7 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.