CVE-2026-6643

Critical

Description

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

SeverityCritical

CVSS9.9

Exploit probability—

ProductAsustor Data Master

PublishedApr 20, 2026

First seenApr 20, 2026

Weakness typeCWE-121CWE-121

How to fix

Update

asustor data_master4.3.3.RR42, 5.1.2.reo1 or later

Vendor advisories

asustor.com/security/security_advisory_detail?id=54

Affected products

Product	Affected versions	Fixed in
asustor data_master	4.1.0.rhu2 ≤ v < 4.3.3.RR42, 5.0.0.ra82 ≤ v < 5.1.2.reo1	4.3.3.RR42, 5.1.2.reo1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.