CVE-2020-8816criticalunder attackCWE-78

CVE-2020-8816

Published · Updated

Follow this CVE+ Monitor AdminLTE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 78%
from disclosure to weaponsame day
Published on NVDMay 29
1st PoCMay 10
metasploitMar 28
CISA KEV+560d
Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

In short

Pi-hole Web v4.3.2 allows an administrator using the dashboard to run arbitrary code on the server by creating a specially crafted DHCP static lease entry. This is critical because administrators can compromise the entire system.

Technical detail

CWE-78 (OS Command Injection) in Pi-hole Web v4.3.2 allows authenticated dashboard users to execute arbitrary OS commands through unsanitized input in DHCP static lease configuration. The vulnerability requires administrative privileges to access the dashboard interface and craft malicious lease parameters that are passed to system commands without proper escaping.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.