RaspAP CVE-2026-101858

Requires an authenticated high-privilege RaspAP administrator (CVSS PR:H) who can reach and submit the WiFi hotspot/SSID configuration handled by WiFiManager::writeWpaSupplicant - this is not remote-unauthenticated. The concrete prerequisite is the ability to set the SSID value that is written into wpa_supplicant; the injection triggers when that value is processed. Limiting factors: administrative authentication to the web GUI is mandatory, so the flaw primarily represents web-admin-to-host-OS escalation rather than external compromise; affected versions are RaspAP raspap-webgui up to 3.5.5 with no vendor-published fix available.

This is a post-authentication OS command injection (CWE-78) in RaspAP's WiFiManager::writeWpaSupplicant, reached by manipulating the SSID value written to wpa_supplicant configuration. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L, score 5.1) is the decisive limiter: PR:H means the attacker must already hold high-privilege (administrative) access to the RaspAP web GUI before they can set the SSID, which sharply narrows the realistic attacker population. The 'E:P' temporal flag and the multi-source signal (a published PoC gist) confirm publicly available exploit code exists, but there is no EPSS score, no CISA KEV listing, and no SSVC decision data supplied, so there is no evidence of active or automatable exploitation. Note a genuine conflict worth flagging: OS command injection normally yields full arbitrary command execution as the web-server user, yet the vendor scored confidentiality/integrity/availability as only Low (VC/VI/VA:L) - this understates the technical impact of command injection and should be verified; my independent assessment rates impact higher. Net: a real but lower-priority issue - the PoC and command-injection primitive matter, but the PR:H gate (admin-to-OS escalation on one's own device) plus a non-responsive vendor with no active-exploitation signal keep it well below emergency status.

An attacker who has already obtained RaspAP administrator credentials (or hijacked an authenticated admin session) submits a WiFi hotspot configuration where the SSID field contains shell metacharacters; when WiFiManager::writeWpaSupplicant writes the wpa_supplicant file, the injected commands execute on the underlying host (typically a Raspberry Pi) as the web-server user. A public proof-of-concept exploit is available as a gist, lowering the effort to reproduce, but exploitation still requires the high-privilege web-GUI access reflected by PR:H.