RaspAP Command Injection vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-39986 · ADVISORY
• RaspAP/raspap-webgui#1303 · WEB
• RaspAP/raspap-webgui commit 1fabc48 · WEB
• RaspAP/raspap-webgui · PACKAGE
• RaspAP/raspap-webgui · WEB
• medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 · WEB
• packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injection.html
• medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2

billz/raspap-webgui のその他の脆弱性

• CVE-2026-24788高 8.7RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be exe…
• CVE-2025-44163中 6.3RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a craft…
• CVE-2024-41637高 8.3RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also posse…
• CVE-2024-2497高 7.2A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file i…
• CVE-2024-28754高 7.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.