Asustor ADM PPTP VPN Client Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the PPTP VPN clients on Asustor's ADM operating system. This vulnerability enables an administrative user to escape the confined web environment and execute arbitrary code on the underlying operating system. The issue arises from inadequate validation of user-supplied input before it is transmitted to a system shell. Successful exploitation of this vulnerability allows an attacker to achieve remote code execution and gain full control over the system. The vulnerability affects Asustor ADM versions 4.1.0 through 4.3.3.RR42, as well as 5.0.0 through 5.1.2.REO1.

Impact

Exploitation of this vulnerability leads to remote code execution on the affected system, allowing an attacker to execute arbitrary code with the same privileges as the user running the PPTP VPN client.