Actively exploited · Published May 29, 2020 · Assigned by mitre

CVE-2020-8816

Critical 9.1 Exploited

In plain English

A critical-severity OS command injection in AdminLTE from Pi-hole. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 78.3% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.0)9.1Critical

Exploit odds (30 days)78.3%top 0.4% of all CVEs

Exploited in the wildYesCISA KEV since Dec 10, 2021

Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 10, 2022.

Official description

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

References

https://github.com/pi-hole/AdminLTE/commits/master x_refsource_MISC
http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html x_refsource_CONFIRM
https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ x_refsource_MISC
https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20 x_refsource_MISC
https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3 x_refsource_MISC
https://github.com/pi-hole/AdminLTE/pull/1165 x_refsource_MISC
http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816 government-resource