The vulnerability is a command injection flaw in the PPTP VPN client of the ADM web interface, caused by insufficient validation of user input that is passed to a system shell. An administrative user can exploit this flaw to break out of the restricted web environment, run arbitrary operating‑system commands, and consequently achieve full system compromise through Remote Code Execution, which aligns with CWE‑78.

ASUSTOR Inc. ADM devices are affected, specifically all builds from ADM 4.1.0 through ADM 4.3.3.RR42 and from ADM 5.0.0 through ADM 5.1.2.REO1.

The CVSS score of 9.4 indicates critical severity, and although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. However, exploitation would require administrative access to the web interface; an attacker with such access could remotely execute arbitrary code on the underlying operating system, leading to a full compromise of the device and its network.