{"id":"CVE-2026-6643","state":"PUBLISHED","title":"A stack-based buffer overflow vulnerability in the VPN Clients on the ADM","description":"A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. \nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.","publishedAt":"2026-04-20T06:34:27.511Z","updatedAt":"2026-04-20T13:46:07.764Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"ASUSTOR1"},"assigner":"ASUSTOR1","products":["ASUSTOR Inc. ADM"],"affected":[{"vendor":"ASUSTOR Inc.","product":"ADM","packageName":"VPN Clients","defaultStatus":"unaffected","versions":[{"version":"4.1.0","status":"affected","lessThanOrEqual":"4.3.3.RR42","versionType":"custom"},{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.1.2.REO1","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":["https://www.asustor.com/security/security_advisory_detail?id=54"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6643.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6643","state":"PUBLISHED","datePublished":"2026-04-20T06:34:27.511Z","dateUpdated":"2026-04-20T13:46:07.764Z","assignerShortName":"ASUSTOR1","assignerOrgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateReserved":"2026-04-20T04:06:43.009Z"},"containers":{"cna":{"title":"A stack-based buffer overflow vulnerability in the VPN Clients on the ADM","descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. \nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1."}],"affected":[{"vendor":"ASUSTOR Inc.","product":"ADM","packageName":"VPN Clients","defaultStatus":"unaffected","versions":[{"version":"4.1.0","status":"affected","lessThanOrEqual":"4.3.3.RR42","versionType":"custom"},{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.1.2.REO1","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":[{"url":"https://www.asustor.com/security/security_advisory_detail?id=54","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","lang":"en","description":"CWE-121 Stack-based buffer overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"ASUSTOR1","orgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateUpdated":"2026-04-20T06:34:27.511Z"},"impacts":[{"capecId":"CAPEC-135","descriptions":[{"lang":"en","value":"CAPEC-135 Format String Injection"}]}],"credits":[{"lang":"en","value":"YU-XIANG HUANG (mlgzackfly)","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-6643","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-04-20T13:20:51.858306Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-20T13:46:07.764Z"}}]}}}