CVE Feed

    Dashboard / CVE / CVE-2026-6643

    CVE-2026-6643

    A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

    Published:Apr 20, 2026
    Last Modified:Apr 22, 2026
    EPS:Apr 20, 2026
    EPSS Score:0.00233
    CVSS Score:9.9

    Affected Products

    Vendor
    Asustor
    Product
    Adm
    Vendor
    Asustor
    Product
    Data Master

    Exploits

    https://github.com/mlgzackfly/CVE-2026-6643

    Common Weakness Enumeration

    CWE-121 Stack-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-67248 (CVSS 8.7) — A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occur…
    CVE-2026-67247 (CVSS 7.1) — A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user…
    CVE-2026-67246 (CVSS 6.9) — A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because u…
    CVE-2026-67245 (CVSS 7) — A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-…
    CVE-2026-67244 (CVSS 8.6) — A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs be…
    CVE-2026-18188 (CVSS 7.1) — A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-…
    CVE-2026-18187 (CVSS 7.1) — A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because us…
    CVE-2026-18186 (CVSS 7.1) — A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because …
    CVE-2026-6644 (CVSS 9.4) — A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an ad…
    CVE-2026-3179 (CVSS 9.2) — The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing direc…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High