CVE-2026-6644: Asustor Data Master RCE Vulnerability

CVE-2026-6644 Overview

A critical command injection vulnerability has been discovered in the PPTP VPN Clients component of ASUSTOR Data Master (ADM). This vulnerability enables an authenticated administrative user to escape the restricted web environment and execute arbitrary commands on the underlying operating system. The flaw stems from insufficient validation of user-supplied input before it is passed to a system shell, ultimately allowing attackers to achieve Remote Code Execution (RCE) and fully compromise the affected NAS system.

Critical Impact

Successful exploitation allows authenticated administrators to execute arbitrary system commands, leading to complete system compromise including data theft, ransomware deployment, and persistent backdoor installation on ASUSTOR NAS devices.

Affected Products

• ASUSTOR Data Master (ADM) versions 4.1.0 through 4.3.3.RR42
• ASUSTOR Data Master (ADM) versions 5.0.0 through 5.1.2.REO1
• ASUSTOR NAS devices running vulnerable ADM firmware

Discovery Timeline

• April 20, 2026 - CVE-2026-6644 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6644

Vulnerability Analysis

This command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) affects the PPTP VPN Clients functionality within ASUSTOR Data Master's web administration interface. The vulnerability allows administrative users to inject arbitrary operating system commands through input fields that are subsequently processed by system shell commands without proper sanitization.

The attack requires network access and administrative privileges, but once those prerequisites are met, the exploitation path is straightforward with no user interaction required. The impact extends beyond the vulnerable component itself, as successful exploitation can affect other system resources and potentially connected network infrastructure. This results in complete compromise of confidentiality, integrity, and availability of both the vulnerable system and potentially adjacent systems.

Root Cause

The root cause of CVE-2026-6644 lies in insufficient input validation within the PPTP VPN client configuration handling code. When user-supplied input is received through the web interface for VPN configuration parameters, the application fails to properly sanitize or escape special characters and shell metacharacters before incorporating them into OS commands.

This lack of input validation allows attackers to inject shell metacharacters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($(...)) to break out of the intended command context and execute additional arbitrary commands with the privileges of the web server process, which typically runs with elevated system privileges on NAS devices.

Attack Vector

The attack vector is network-based, requiring the attacker to have valid administrative credentials to the ADM web interface. Once authenticated, the attacker can navigate to the PPTP VPN client configuration section and inject malicious payloads into vulnerable input fields.

A typical exploitation scenario involves an attacker crafting input containing shell metacharacters followed by malicious commands. When the ADM system processes this input, it executes both the intended VPN configuration command and the injected malicious commands. This can be used to establish reverse shells, download and execute malware, modify system configurations, exfiltrate sensitive data, or deploy ransomware—a particularly devastating outcome for NAS devices that typically store large volumes of important data.

Detection Methods for CVE-2026-6644

Indicators of Compromise

• Unusual process spawning from the ADM web server process, particularly shell processes (/bin/sh, /bin/bash) with unexpected command arguments
• Network connections to unusual external IP addresses originating from the NAS device
• Unexpected files created in system directories or temporary folders
• Modifications to system configuration files or scheduled tasks outside of normal administrative activity

Detection Strategies

• Monitor ADM web interface logs for suspicious input patterns containing shell metacharacters in VPN configuration requests
• Implement network monitoring to detect outbound connections from NAS devices to known malicious infrastructure or unusual ports
• Deploy file integrity monitoring on critical ADM system directories to detect unauthorized modifications
• Review authentication logs for administrative access from unusual source IPs or at unusual times

Monitoring Recommendations

• Enable comprehensive logging for the ADM web interface and VPN configuration components
• Configure SIEM alerts for command injection attack patterns in web server logs
• Monitor for privilege escalation attempts and unusual process hierarchies on ASUSTOR NAS devices
• Implement network segmentation to limit the blast radius if a NAS device is compromised

How to Mitigate CVE-2026-6644

Immediate Actions Required

• Update ASUSTOR Data Master to a patched version as soon as available from ASUSTOR
• Restrict administrative access to the ADM web interface to trusted IP addresses only
• Disable PPTP VPN client functionality if not actively required until patching is possible
• Review administrative account usage and enforce strong, unique passwords with multi-factor authentication where supported

Patch Information

ASUSTOR has released information regarding this vulnerability in Security Advisory #55. Administrators should consult this advisory for the latest patched ADM versions and apply updates immediately. The vulnerability affects ADM versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1, so ensure your system is updated beyond these affected version ranges.

Workarounds

• Implement network-level access controls (firewall rules, VLANs) to restrict access to the ADM administration interface
• Disable the PPTP VPN client feature entirely if it is not required for business operations
• Consider placing ASUSTOR NAS devices behind a VPN rather than exposing the web interface directly
• Implement web application firewall (WAF) rules to filter common command injection patterns in requests to the ADM interface

# Network-level mitigation: Restrict ADM web interface access
# Example iptables rules to limit administrative access to trusted IPs

# Allow ADM web access only from management subnet
iptables -A INPUT -p tcp --dport 8000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP