This vulnerability (CVE-2026-6643) involves a stack-based buffer overflow in the VPN Clients of ASUSTOR ADM software. The root cause is the use of unbounded sscanf() calls and passing user-controlled data directly to printf(), which can lead to memory corruption. The lack of Position Independent Executable (PIE) and Stack Canary security features exacerbates the risk, enabling an authenticated remote attacker to execute arbitrary code as the web server user. Affected versions include ADM 4.1.0 through 4.3.3.RR42 and 5.0.0 through 5.1.2.REO1. The CVSS 4.0 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No patch or official remediation has been published as of the vulnerability disclosure date.

Successful exploitation allows an authenticated remote attacker to execute arbitrary code with the privileges of the web server user on affected ADM versions. This could lead to full compromise of the affected system's VPN client component, potentially impacting confidentiality, integrity, and availability of the device and its services. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the VPN Clients interface to trusted users only and monitor for unusual activity. Avoid exposing the ADM web server to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.