CVE-2026-6643
CRITICALASUSTOR ADM 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1 - Authenticated Remote Code Execution via VPN Client Buffer Overflow
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-6643. PoCs published by mlgzackfly.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-6643, targeting ASUSTOR ADM 5.1.2. The exploit leverages a format string vulnerability (CWE-134) and a stack buffer overflow (CWE-121) in the `vpnupload.cgi` component to achieve remote code execution (RCE). The exploit is well-documented with detailed technical analysis, including stack layout, mitigation bypasses, and step-by-step exploitation instructions.
Description
A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.
Exploits (1)
This repository contains a functional exploit for CVE-2026-6643, targeting ASUSTOR ADM 5.1.2. The exploit leverages a format string vulnerability (CWE-134) and a stack buffer overflow (CWE-121) in the `vpnupload.cgi` component to achieve remote code execution (RCE). The exploit is well-documented with detailed technical analysis, including stack layout, mitigation bypasses, and step-by-step exploitation instructions.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H