Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2020-8816

🗓️ 29 May 2020 18:57:14Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 1082 Views🌐 WEB

Pi-hole Web v4.3.2 allows Remote Code Execution via crafted DHCP static lease

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
0daydb		Pi-Hole 4.3.2 DHCP MAC OS CVE-2020-8816 - Command Execution
30 May 202014:57
–0daydb
0daydb		QNAP QTS And Photo Station 6.0.3 - Remote Command Execution
30 May 202014:56
–0daydb
0daydb		WordPress Multi-Scheduler 1.0.0 - Cross Site Request Forgery
30 May 202014:58
–0daydb
0day.today		Pi-hole 4.3.2 - Remote Code Execution (Authenticated) Exploit
4 Aug 202000:00
–zdt
GithubExploit		Exploit for OS Command Injection in Pi-Hole
10 May 202001:12
–githubexploit
GithubExploit		Exploit for OS Command Injection in Pi-Hole
4 Aug 202010:23
–githubexploit
GithubExploit		Exploit for OS Command Injection in Pi-Hole
15 Jun 202018:24
–githubexploit
GithubExploit		Exploit for OS Command Injection in Pi-Hole
6 Aug 202014:04
–githubexploit
ATTACKERKB		CVE-2020-8816
29 May 202000:00
–attackerkb
BDU FSTEC		The vulnerability of the application for blocking advertisements and Pi-hole internet trackers arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows a violator to execute arbitrary code.
6 Mar 202300:00
–bdu_fstec
Rows per page
NVD
Node
pi-holepi-holeRange≤4.3.2
ParameterPositionPathDescriptionCWE
pwrequest bodyadmin/index.phpAuthenticated RCE via crafted DHCP static lease in Pi-hole Web 4.3.2 (CVE-2020-8816).CWE-78
AddMACrequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78
fieldrequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78
AddIPrequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78
AddHostnamerequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78
addstaticrequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78
tokenrequest bodyadmin/settings.phpPost to DHCP settings to inject command execution payload via vulnerable parameter 'AddMAC' containing HEX-encoded PHP -r shell.CWE-78

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:26Current
7High risk
Vulners AI Score7
CVSS 26.5
CVSS 3.17.2
CVSS 39.1
EPSS0.7819
SSVC
CWE-78In Wild
pi-holewebcve-2020-8816remote code executiondhcp static lease
1082