CVE-2026-6644

Katalog CVE

CVSS 9.1 · Critical EPSS 2,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada asustor data master. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

Rincian

Terbit di NVD

20 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://https://www.asustor.com/security/security_advisory_detail?id=55 broken link · advisory vendor
• https://uky007.github.io/CVE-2026-6644/