CVE-2026-6644

Critical

Description

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

SeverityCritical

CVSS9.1

Exploit probability—

ProductAsustor Data Master

PublishedApr 20, 2026

First seenApr 20, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

asustor data_master4.3.3.RR42, 5.1.2.reo1 or later

Vendor advisories

https//www.asustor.com/security/security_advisory_detail?id=55

Affected products

Product	Affected versions	Fixed in
asustor data_master	4.1.0.rhu2 ≤ v < 4.3.3.RR42, 5.0.0.ra82 ≤ v < 5.1.2.reo1	4.3.3.RR42, 5.1.2.reo1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.