CVE-2026-6644 is a critical (CVSS 9.1) command injection in the PPTP VPN client of ASUSTOR ADM. An administrative user could escape the restricted web environment and run commands on the operating system. ASUSTOR fixed it in ADM 5.1.3.RGO1 and ADM 4.3.3.RSU1. Update and secure admin access.
What's affected
- Product: ASUSTOR Data Master (ADM), in the PPTP VPN client feature.
- Affected versions: ADM 4.1.0 through 4.3.3.RR42, and ADM 5.0.0 through 5.1.2.REO1.
- Fixed versions: ADM 5.1.3.RGO1 for the 5.x branch, and ADM 4.3.3.RSU1 for 4.3, 4.2 and 4.1.
- Weakness: CWE-78 OS command injection. ASUSTOR says user supplied input is not validated before it is passed to a system shell.
- Severity: CVSS 3.1 9.1 in the record, high privileges required. ASUSTOR's CVSS 4.0 score is 9.4.
- Requirement: an administrator login. The researcher who reported it notes that ADM's default administrator account uses admin for both username and password.
How to check if you're exposed
In the ADM web interface, open Settings and look for the ADM Update page, which shows the installed ADM version. Menu names can differ slightly between ADM branches.
Compare the version with the affected range: ADM 4.1.0 through 4.3.3.RR42, and ADM 5.0.0 through 5.1.2.REO1. The fixed builds are ADM 5.1.3.RGO1 and ADM 4.3.3.RSU1. If you run several NAS units, check each one, including units that are rarely opened.
Also check whether the management interface is reachable from the internet. From a machine outside your network, a connection to the ADM port should not succeed.
What to do now
- List every ASUSTOR NAS and its ADM version.
- Update to ADM 5.1.3.RGO1 or ADM 4.3.3.RSU1 or later.
- Replace the default administrator password and use a long, unique one.
- Do not expose the ADM management interface to the internet. Restrict it to trusted networks.
- Check the VPN client settings and scheduled tasks for entries you did not create.
Why it matters
The reporting researcher's write up says the PPTP server address was placed into a configuration file that is later run through a shell, while the username and password fields were escaped. That is a typical injection pattern: most inputs were handled and one was missed. The result is that an administrator, who should be confined to the web interface, can reach the underlying system as root.
The administrator requirement is important and also easy to overstate. It means this is not a pre authentication bug, but NAS devices with default credentials or exposed login pages are common. The researcher lists malware installation, persistence and use as proxy infrastructure as possible outcomes of a compromised NAS. The CISA KEV flag is false and ASUSTOR does not report exploitation in its advisory.
Quick check
Is this a pre authentication remote code execution?
No. It needs an administrator login. That is why default credentials and an exposed management page are the real risk.
What else should I do besides patching?
Keep the management interface off the internet, use a strong admin password, and review the NAS for unknown settings.
Sources
- ASUSTOR security advisory AS-2026-006: PPTP VPN Client
- Researcher write up for CVE-2026-6644
- Gold record for CVE-2026-6644
Last reviewed: 19 October 2026.
