peter bassill · operator
$ cve CVE-2020-8816 JSON

CVE-2020-8816 KEV EXPLOIT

7.2
HIGH · CVSS 3.1 · EPSS 78.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-06-10.

Description

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Scoring

CVSS7.2 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS78.19% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2022-06-10
Public exploityes
Published2020-05-29
Last modified2026-06-17

CISA KEV

NamePi-Hole AdminLTE Remote Code Execution Vulnerability
Added2021-12-10
Due2022-06-10
Vendor / productPi-hole / AdminLTE
Ransomware usenone reported

Affected (1)

VendorProduct
pi-holepi-hole

Public exploits

SourceTitleDate
exploit-dbPi-hole 4.3.2 - Remote Code Execution (Authenticated)2020-08-04

References

→ the Explorer  ·  watch your stack  ·  NVD