module
RaspAP Unauthenticated Command Injection
| Disclosed |
|---|
| Jul 31, 2023 |
Disclosed
Jul 31, 2023
Description
RaspAP is feature-rich wireless router software that just works
on many popular Debian-based devices, including the Raspberry Pi.
A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows
unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id
parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
Successfully tested against RaspAP 2.8.0 and 2.8.7.
on many popular Debian-based devices, including the Raspberry Pi.
A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows
unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id
parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
Successfully tested against RaspAP 2.8.0 and 2.8.7.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.