CVE-2022-39987
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
| Software | From | Fixed in |
|---|---|---|
| raspap / raspap | 2.8.0 | 2.9.2.x |
billz / raspap-webgui
|
2.8.0 | 2.9.5 |
- https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php
- https://github.com/RaspAP/raspap-webgui/commit/e87e7d1d3a61617430851f2a040379de1ff3dd9d
- https://github.com/RaspAP/raspap-webgui/pull/1395
- https://github.com/RaspAP/raspap-webgui/releases/tag/2.9.5
- https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
- https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime