Critical Zero-Day Exploit in ASUSTOR ADM PPTP VPN Client Exposes NAS Devices to Root-Level Attacks A proof-of-concept (PoC) exploit has been released for CVE-2026-6644, a now-patched critical zero-day vulnerability in ASUSTOR’s ADM PPTP VPN Client. The flaw, rated 9.4 (Critical) under CVSS v4.0, allows authenticated administrators to execute arbitrary commands with root privileges on vulnerable NAS devices. The vulnerability stems from an OS command injection flaw in `/portal/apis/settings/vpn.cgi`, where the PPTP server address parameter is written directly into a `pppd` configuration file without proper input validation. Since `pppd` executes the parameter via `/bin/sh`, a malicious server address can break out of the web environment, enabling root-level command execution. While the flaw requires administrator authentication, its risk is heightened by ASUSTOR’s default credentials (`admin/admin`), making unpatched systems trivially exploitable. Successful exploitation could lead to full system compromise, including malware deployment, data exfiltration, DDoS infrastructure setup, and persistence mechanisms. ### Affected Versions The vulnerability impacts multiple ADM firmware releases: - ADM 4.1.0 – 4.3.3.RR42 - ADM 5.0.0 – 5.1.2.REO1 ### Attack Surface & Exposure Internet scans reveal approximately 19,000 internet-facing ASUSTOR NAS hosts, though not all may be vulnerable or actively exploited. The public PoC increases the urgency for remediation. ### Patch & Mitigations ASUSTOR released a fix in ADM 5.1.3.RGO1 under security advisory AS-2026-006. Recommended actions include: - Updating to ADM 5.1.3.RGO1 or later - Blocking WAN access to the ADM management interface - Changing default credentials - Disabling unused services, including PPTP VPN - Restricting administration to trusted VPN networks Given the severity and public exploit availability, affected deployments should prioritize patching.

ASUSTOR NAS devices are targeted recently by the DeadBolt ransomware group. The attackers encrypted the files on an ASUSTOR device and renamed them with .deadbolt file extension. A ransom note was being displayed on the login screen of the users with a demand for 0.03 bitcoin worth $1150 to receive a decryption key.