CVE-2026-6644: Command Injection in the ASUSTOR NAS VPN Client

CVE-2026-6644: Command Injection in the ASUSTOR NAS VPN Client

A researcher analyzed the vulnerability CVE-2026-6644 in the ASUSTOR VPN client and uncovered an interesting implementation detail.

When creating a PPTP configuration, the vulnerable function FUN_00403f21 in the vpn.cgi script correctly escaped the username and password before writing them to pppd, but not the VPN server IP address. As a result, the server field became the source of the command injection.

The error is notable because the most obvious user-controlled fields (credentials) were protected but another field was considered "safe", even though it accepted user input through the administration web interface. As a result, the code could be executed on the ASUSTOR Data Master (ADM) operating system with root privileges.

ADM versions 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1 are vulnerable. The researcher's Censys-based analysis showed that the issue affects 19,000 nodes.

Article: https://nefariousplan.com/posts/asustor-vpn-escapes-credentials-not-server

PoC: https://github.com/uky007/CVE-2026-6644