CVE-2023-30260

HIGH

RaspAP raspap-webgui < 2.8.8 - Remote Command Injection via Hostapd Settings Form

Title source: llm

Description

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

References (2)

Core 2

Core References

Exploit, Mitigation, Third Party Advisory

https://eldstal.se/advisories/230328-raspap.html

Patch

https://github.com/RaspAP/raspap-webgui/pull/1322

Scores

CVSS v3 8.8

EPSS 0.0248

EPSS Percentile 82.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (2)

billz/raspap-webgui 0 - 2.8.9Packagist

raspap/raspap < 2.8.8

Published Jun 23, 2023

Tracked Since Feb 18, 2026