CVEvulnerability
CVE-2020-24572
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-08-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).
Affected configurations
• raspap raspap 2.5
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://deadb0x.io/lunchb0x/cve-2020-24572/ Exploit, Third Party Advisory
- https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 Patch, Third Party Advisory
- https://github.com/billz/raspap-webgui/releases Release Notes, Third Party Advisory
- https://github.com/lb0x Third Party Advisory
- https://deadb0x.io/lunchb0x/cve-2020-24572/ Exploit, Third Party Advisory
- https://github.com/billz/raspap-webgui/commit/dd5ab7bdc213381ee552001dd80c41ca47afab00 Patch, Third Party Advisory
- https://github.com/billz/raspap-webgui/releases Release Notes, Third Party Advisory
- https://github.com/lb0x Third Party Advisory