VulnCheck KEV: CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

RaspAP Command Injection (CVE-2021-38556)

A command injection vulnerability exists in RaspAP. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

GHSA-7VPH-P634-VRQF Command Injection in RaspAP 2.6.6

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

Command Injection in RaspAP 2.6.6

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

GHSA-536P-4PCJ-5MR9 raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

Command Injection

billz/raspap-webgui is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by injecting malicious code via the POST request...

RaspAP Remote Code Execution Vulnerability (CNVD-2021-94941)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. raspap-webgui in RaspAP version 2.6.6 is vulnerable to remote code execution. The vulnerability stems from insecure...

RaspAP Command Injection Vulnerability (CNVD-2021-94940)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. a command injection vulnerability exists in includes/configureclient.php in RaspAP version 2.6.6. An attacker could...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38556

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38556

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

Command injection

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

Command injection

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38556

CVE-2021-38556 concerns a command injection in includes/configure_client.php within RaspAP 2.6.6. The Red Hat, OSV, GitHub advisories and CNVD/CVE records consistently describe a vulnerability where an attacker could execute arbitrary commands on the affected system via this PHP component. The im...

CVE-2021-38556

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38557

Affected software: raspap-webgui (RaspAP) 2.6.6. Root cause: insecure sudoers permissions permit the www-data user to run /etc/raspap/hostapd/enablelog.sh as root without a password and to overwrite that script with arbitrary executable content. Impact: potential remote code execution as root. Ex...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...