CVE-2026-6643CWE-121

A stack-based buffer overflow vulnerability in the VPN Clients on the ADM

High · published April 20, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user.

Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00764 · 54.9th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-04-20T06:34Z
EPSS history
Timeline
  • 20 APR 06:34Z
    A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
    cvelistv5