Which versions of Adm are affected by CVE-2026-6643?

CVE-2026-6643 is a remote code execution vulnerability affecting ASUSTOR ADM (Data Master) versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1 that allows authenticated administrators to execute arbitrary…

How to fix or mitigate CVE-2026-6643?

Within 24 hours: Identify all ASUSTOR ADM deployments running versions 4.1.0-4.3.3.RR42 or 5.0.0-5.1.2.REO1; audit administrative user accounts and review recent login logs for unauthorized access; document current firmware versions. Within 7 days: Disable VPN client functionality in ADM until patch availability; implement network segmentation to restrict administrative console access to trusted internal IP ranges only; enforce multi-factor authentication for all administrator accounts if supported by your deployment. Within 30 days: Monitor ASUSTOR security advisories daily for patch release; establish patching schedule for immediate deployment once vendor releases fix; conduct post-patch validation testing in non-production environment first.

Adm CVE-2026-6643

Q: What is the CVSS score of CVE-2026-6643?

CVE-2026-6643 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-23786 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-20 ASUSTOR1

GHSA-46vm-f48w-xhvv

Stack Overflow Buffer Overflow RCE Adm

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 07:27 vuln.today

CVSS changed

Apr 20, 2026 - 07:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 07:15 euvd

EUVD-2026-23786

Analysis Generated

Apr 20, 2026 - 07:15 vuln.today

CVE Published

Apr 20, 2026 - 06:34 nvd

HIGH 8.6

DescriptionCVE.org

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

AnalysisAI

Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attackers to execute arbitrary code via stack-based buffer overflow in VPN client components. The vulnerability combines unbounded sscanf() calls with format string weaknesses (printf with user-controlled data), exploitable due to absent PIE and stack canary protections. EPSS exploitation probability is low (0.23%, 46th percentile) with no public exploit code identified at time of analysis, suggesting limited real-world targeting despite high CVSS score.

Technical ContextAI

This vulnerability affects ASUSTOR Data Master (ADM), the Linux-based operating system for ASUSTOR NAS devices, specifically within VPN client functionality. The root cause is CWE-121 (stack-based buffer overflow) arising from unsafe string handling: unbounded sscanf() reads user input without length validation, while printf() directly processes attacker-controlled format strings. The binary lacks Position Independent Executable (PIE) compilation and stack canaries-exploit mitigation techniques standard in modern toolchains. Without PIE, attackers can reliably predict memory addresses for return-oriented programming (ROP) gadgets. Without stack canaries, buffer overflows can directly overwrite return addresses without detection. The CPE identifier (cpe:2.3:a:asustor_inc.:adm) confirms this affects the ADM platform across two major version branches (4.x and 5.x), indicating the vulnerable code persisted through significant product iterations.

RemediationAI

Apply ASUSTOR security patch per advisory https://www.asustor.com/security/security_advisory_detail?id=54, which should provide updated ADM firmware versions beyond 4.3.3.RR42 (for 4.x branch) and 5.1.2.REO1 (for 5.x branch)-consult the advisory for exact patched release numbers as they are not specified in available CVE data. Until patching, implement compensating controls: disable VPN client functionality in ADM if not operationally required (eliminates attack surface but removes VPN capability), restrict ADM administrative interface access to trusted management networks only via firewall rules (reduces attacker positioning opportunities but does not prevent insider threats), enforce multi-factor authentication for all ADM administrative accounts (increases credential compromise difficulty but adds operational overhead), and audit administrative login activity for anomalous access patterns (detection-focused, does not prevent exploitation). Note that disabling VPN clients may impact backup or remote access workflows-assess operational dependencies before implementing. No workaround fully mitigates the vulnerability; patching is the definitive solution.