Vulnerability Details : CVE-2020-8816

Public exploit exists!
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Published 2020-05-29 19:15:11
Updated 2025-02-04 20:15:39
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2020-8816

Threat overview for CVE-2020-8816

Top countries where our scanners detected CVE-2020-8816
Top open port discovered on systems with this issue 22
IPs affected by CVE-2020-8816 1
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2020-8816!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2020-8816 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Pi-Hole AdminLTE Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2020-8816
Added on 2021-12-10 Action due date 2022-06-10

Exploit prediction scoring system (EPSS) score for CVE-2020-8816

EPSS FAQ
96.74%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-8816

  • Pi-Hole DHCP MAC OS Command Execution
    Disclosure Date: 2020-03-28
    First seen: 2020-05-28
    exploit/unix/http/pihole_dhcp_mac_exec
    This exploits a command execution in Pi-Hole <= 4.3.2. A new DHCP static lease is added with a MAC address which includes an RCE. Exploitation requires /opt/pihole to be first in the $PATH due to exploitation constraints. DHCP server is not required to be running.

CVSS scores for CVE-2020-8816

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.5
 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P
8.0
6.4
 NIST
9.1
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
2.3
6.0
 MITRE
7.2
 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1.2
5.9
 NIST

CWE ids for CVE-2020-8816

References for CVE-2020-8816

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close