Pi-hole · AdminLTE
CVE-2020-8816
Pi-Hole AdminLTE Remote Code Execution Vulnerability
Exploited in attacks
Critical 9.1 Attack chance: 78%
What it is
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 10, 2022
- Added to the CISA list
- December 10, 2021
- Published
- May 29, 2020
- Severity
- Critical 9.1 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 78% in the top 0.4% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (7)
- https://github.com/pi-hole/AdminLTE/commits/master
- http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html
- https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/
- https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20
- https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3
- https://github.com/pi-hole/AdminLTE/pull/1165
- http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.