keraattin/CVE-2026-35517

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based vulnerability scanner for CVE-2026-35517. It detects vulnerable Pi-hole FTLDNS instances by querying the web interface and API to retrieve the FTL version, then comparing it against the known vulnerable range (6.0 to <6.6). It does not contain any exploit code or attempt to trigger the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python vulnerability scanner and documentation for CVE-2026-35517. The Python script performs read-only version detection against Pi-hole instances; it does not send injection payloads, execute commands, or establish persistence. The README describes the vulnerability and provides detection and remediation guidance. No concealed executable behavior, deceptive payloads, or operator-directed harm were observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarePi-hole FTLDNS
Attack typesvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script's primary function is to detect vulnerable Pi-hole instances by querying version information and comparing it to a known vulnerable range. It explicitly states 'No injection payloads are sent. The test is entirely read-only and safe.' in the README and does not contain any code to construct or send a malicious payload to exploit the newline injection vulnerability. This is consistent with a scanner, not an exploit.

README.md:238CVE-2026-35517_PiHole_FTLDNS_detector.py:1-503

Requirements

  • Network access to the target Pi-hole instance's web interface (HTTP/HTTPS).CVE-2026-35517_PiHole_FTLDNS_detector.py:77-83
  • Python 3 with the 'packaging' library installed.requirements.txt:1-2

Observed behavior

  • Sends HTTP/HTTPS GET requests to common Pi-hole admin paths (e.g., /admin/, /admin/index.php) to fingerprint the target.CVE-2026-35517_PiHole_FTLDNS_detector.py:97-123
  • Queries Pi-hole API endpoints (e.g., /api/info/version, /admin/api.php?versions) to retrieve the FTLDNS version string.CVE-2026-35517_PiHole_FTLDNS_detector.py:126-187
  • Parses the retrieved FTL version and compares it against the vulnerable range (6.0 <= version < 6.6) to determine if the target is vulnerable.CVE-2026-35517_PiHole_FTLDNS_detector.py:223-277
  • Outputs a vulnerability assessment (VULNERABLE, PATCHED, NOT AFFECTED, or UNKNOWN) and lists related CVEs without sending any injection payloads.CVE-2026-35517_PiHole_FTLDNS_detector.py:331-391
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
CVE-2026-35517_PiHole_FTLDNS_detector.pyThe script performs passive version detection via HTTP GET requests to Pi-hole admin and API endpoints. It parses version strings and compares them against the vulnerable range (6.0 to <6.6). No injection payloads are sent.CVE-2026-35517_PiHole_FTLDNS_detector.py:77-189CVE-2026-35517_PiHole_FTLDNS_detector.py:223-277
Documentation
README.mdThe README describes the vulnerability, affected versions, detection methods, and remediation steps. It explicitly states that the Python scanner sends no injection payloads and is read-only.README.md:225-238
Review boundaries

What the analysis did not establish

  • The evidence includes a reference to an Nmap NSE script (CVE-2026-35517_PiHole_FTLDNS.nse) in the README, but the script file itself was not included in the selected text files and is listed as an omitted file in the packet metadata.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its behavior against a live target is not verified.
  • One file (CVE-2026-35517_PiHole_FTLDNS.nse) was omitted from the text evidence and was not reviewed. Its metadata indicates it is a text file, but its content was not supplied.
  • Binary files were not analyzed per the evidence envelope policy; any backdoor would need to reside in the unreviewed NSE script or binary content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1