CVE-2026-6643 is a critical (CVSS 9.9) stack based buffer overflow in the VPN clients of ASUSTOR ADM. An authenticated remote attacker could run code as the web server user. ASUSTOR fixed it in ADM 5.1.3.RGO1 and ADM 4.3.3.RSU1. Update and keep the admin interface off the internet.
What's affected
- Product: ASUSTOR Data Master (ADM), the NAS operating system, in the VPN client feature.
- Affected versions: ADM 4.1.0 through 4.3.3.RR42, and ADM 5.0.0 through 5.1.2.REO1.
- Fixed versions: ADM 5.1.3.RGO1 for the 5.x branch, and ADM 4.3.3.RSU1 for 4.3, 4.2 and 4.1.
- Weakness: CWE-121 stack based buffer overflow. ASUSTOR cites unbounded sscanf() use and user controlled data passed directly to printf().
- Severity: CVSS 3.1 9.9 in the record, with a changed scope and low privileges required. ASUSTOR's own CVSS 4.0 score is 8.6.
- ASUSTOR notes the build lacks PIE and stack canary protections.
How to check if you're exposed
In the ADM web interface, open Settings and look for the ADM Update page, which shows the installed ADM version. Menu names can differ slightly between ADM branches.
Compare the version with the affected range: ADM 4.1.0 through 4.3.3.RR42, and ADM 5.0.0 through 5.1.2.REO1. The fixed builds are ADM 5.1.3.RGO1 and ADM 4.3.3.RSU1. If you run several NAS units, check each one, including units that are rarely opened.
Also check whether the management interface is reachable from the internet. From a machine outside your network, a connection to the ADM port should not succeed.
What to do now
- List every ASUSTOR NAS and its ADM version.
- Update to ADM 5.1.3.RGO1 or ADM 4.3.3.RSU1 or later.
- Change any default or weak administrator password.
- Remove the ADM management interface from the internet, or put it behind a VPN or allow list.
- Review the VPN client settings and the NAS users for changes you do not recognise.
Why it matters
A stack buffer overflow writes more data into a fixed size memory area than it can hold, and the overflow lands in memory that controls what the program does next. ASUSTOR says the bug came from reading input without a length limit and from passing that input straight to a formatting function. Modern builds add protections such as stack canaries, and ASUSTOR notes this build lacked them, which makes such a bug easier to turn into code execution.
The attacker has to be logged in, so default or weak admin credentials raise the risk. NAS devices hold backups and shared files, so a compromised one is a good place for an attacker to stay. The CISA KEV flag is false and ASUSTOR does not report exploitation.
Quick check
Does the attacker need an account?
Yes, the advisory says authenticated. The risk goes up sharply if admin credentials are weak or the default.
Is there a fix for older ADM 4 units?
ASUSTOR lists ADM 4.3.3.RSU1 for ADM 4.3, 4.2 and 4.1.
Sources
Last reviewed: 19 October 2026.
