[ CVE-2020-8816 · Published 29 May 2020 ]
Pi-Hole AdminLTE Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 7.2
EPSS 78%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-12-10
- EPSS: 78% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 10 Jun 2022): Apply updates per vendor instructions.
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.htmlThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
- github.com/pi-hole/AdminLTE/commits/masterPatchThird Party Advisory
- github.com/pi-hole/AdminLTE/pull/1165PatchThird Party Advisory
- github.com/pi-hole/AdminLTE/releases/tag/v4.3.3Release NotesThird Party Advisory
- natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-executionBroken LinkExploitThird Party Advisory
- twitter.com/Nate_Kappa/status/1243900213665902592Broken LinkPress/Media Coverage
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource