rootpwn

medium · CVSS v3 4.7 · CVSS v4 5.1

CVE-2026-101858

A remote OS command injection flaw exists in RaspAP raspap-webgui versions up to 3.5.5, allowing attackers to execute arbitrary commands via

Overview

A remote OS command injection flaw exists in RaspAP raspap-webgui versions up to 3.5.5, allowing attackers to execute arbitrary commands via the SSID field. The vulnerability is triggered by manipulating the ssid argument in WiFiManager::writeWpaSupplicant. It can be exploited without authentication, potentially compromising the underlying system.

Description

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: attackers can read sensitive system files. Integrity: they can modify or delete configuration files. Availability: they can disrupt network services. The flaw affects devices running the vulnerable RaspAP web interface, such as home routers and IoT gateways.

Remediation

Upgrade RaspAP raspap-webgui to version 3.5.6 or later where the input is sanitized. If upgrade is not possible, disable remote access to the web interface or restrict it to trusted IPs. Additionally, apply a firewall rule to block outbound connections to the wpa_supplicant command or use SELinux/AppArmor to confine the web server process.

Risk context

Severity is medium (CVSS 4.7/5.1). No EPSS data available. The vulnerability is publicly known and exploitable remotely, so defenders should prioritize remediation.

Affected products

  • RaspAP raspap-webgui 3.5.5 and earlier

Scores

Severity
medium
CVSS v2
5.8
CVSS v3
4.7
CVSS v4
5.1
EPSS
—

os-command-injection raspap remote-exploit web-interface medium-severity command-injection networking

← All CVEs

Related CVEs

medium

CVE-2026-101279

OpenDMARC up to 1.4.2 contains an integer overflow in the pct argument of the DMARC parser, which can be triggered remotely and may corrupt memory or cause a denial of service. It affects any mail server using the vulnerable OpenDMARC library.

View analysis

medium

CVE-2026-101859

A command‑injection flaw exists in RaspAP raspap‑webgui’s OpenVPN configuration handler, allowing remote attackers to execute arbitrary OS commands via the cfg_id parameter. This can compromise the confidentiality, integrity, and availability of the device and any connected networks.

View analysis

medium

CVE-2026-102241

A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-102244

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.

View analysis