Exploit Exposed: Public PoC Disclosed for Critical Root RCE in ASUSTOR ADM (CVE-2026-6644)

A critical authenticated remote root vulnerability (CVE-2026-6644) was disclosed in ASUSTOR ADM’s PPTP VPN Client: an unsanitized PPTP server address is written into pppd’s pty directive and executed via /bin/sh, allowing command injection and full system takeover. Proof-of-concept code is public, up to ~19,000 internet-facing ASUSTOR hosts may be reachable, and ASUSTOR published an emergency firmware update (ADM 5.1.3.RGO1) with guidance to restrict WAN management access and use strong admin credentials.