What is the CVSS score of CVE-2026-24788?

CVE-2026-24788 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-24788?

Within 24 hours: Identify all systems running RaspAP and document their version numbers and network exposure; restrict administrative access to trusted networks only via firewall rules. Within 7 days: Implement network segmentation to isolate RaspAP instances; enforce strong authentication and consider disabling remote management if operationally feasible. Within 30 days: Evaluate upgrade to version 3.3.6 or later when available; monitor vendor security advisories for patch release and deploy immediately upon availability.

CVE-2026-24788

HIGH

OS Command Injection (CWE-78)

2026-02-02 vultures@jpcert.or.jp

GHSA-4wwf-f7w3-94f5

Command Injection

8.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 05:16 nvd

HIGH 8.8

DescriptionCVE.org

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

AnalysisAI

Authenticated command injection in RaspAP versions before 3.3.6 allows logged-in users to execute arbitrary operating system commands with full system privileges. The vulnerability requires valid credentials but presents no additional complexity barriers, making it a critical post-authentication risk for deployments where user access controls may be weak. No patch is currently available.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects RaspAP raspap-webgu. RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.