Vulnerability · Published Apr 20, 2026 · Assigned by ASUSTOR1

CVE-2026-6643A stack-based buffer overflow vulnerability in the VPN Clients on the ADM

High 8.6

In plain English

A high-severity stack buffer overflow in ADM from ASUSTOR Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR Inc.	ADM	4.1.0 – through 4.3.3.RR425.0.0 – through 5.1.2.REO1

Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://www.asustor.com/security/security_advisory_detail?id=54 vendor-advisory