A command injection vulnerability was found in the PPTP VPN Clients on the ADM.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 20, 2026 · NIST NVD

   Detected

   A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Rem

2. Jun 17, 2026 · NIST NVD

   Updated

   A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Rem

Affected

• cpe asustor/data masterversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-6644

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6644

  A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation

  nvd.nist.gov

References

• Broken Link · https
• Reference · uky007.github.io