CVE Explorer
CVE-2026-6644
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system.
Affected products and versions include: fr
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","packageName":"PPTP VPN Clients","product":"ADM","vendor":"ASUSTOR Inc.","versions":[{"lessThanOrEqual":"4.3.3.RR42","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThanOrEqual":"5.1.2.REO1","status":"affected","version":"5.0.0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:29d7c2111f8c08d2d429186484d98cd7a33c970a9969ca4283becd1e2ef41637 · sha256:81e12f174b838063… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpac…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:29d7c2111f8c08d2d429186484d98cd7a33c970a9969ca4283becd1e2ef41637 · sha256:81e12f174b838063… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:29d7c2111f8c08d2d429186484d98cd7a33c970a9969ca4283becd1e2ef41637 · sha256:81e12f174b838063… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"tags":["vendor-advisory"],"url":"https://https://www.asustor.com/security/security_advisory_detail?id=55"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:29d7c2111f8c08d2d429186484d98cd7a33c970a9969ca4283becd1e2ef41637 · sha256:81e12f174b838063… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://uky007.github.io/CVE-2026-6644/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:29d7c2111f8c08d2d429186484d98cd7a33c970a9969ca4283becd1e2ef41637 · sha256:81e12f174b838063… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.