Ftl CVE-2026-35521

Authenticated attacker with access to Pi-hole FTL Web interface versions 6.0–6.5. Attacker must modify the DHCP hosts configuration parameter (dhcp.hosts) to inject newline characters and arbitrary dnsmasq directives, achieving command execution on the host system.

The CVSS score of 8.8 reflects critical impact across confidentiality, integrity, and availability with straightforward network-based exploitation requiring only low-privilege authentication. However, real-world risk assessment reveals nuanced prioritization factors. The PR:L (low privilege required) vector indicates attackers need valid Pi-hole administrative credentials, substantially reducing the attack surface compared to unauthenticated vulnerabilities. EPSS data was not provided, but the combination of high technical impact (full system compromise) and low attack complexity suggests elevated exploitation probability once credentials are obtained. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation campaigns at analysis time. The primary risk scenario involves credential compromise through phishing, credential stuffing, or lateral movement in already-breached networks where Pi-hole instances serve as pivot points. Environments with single-administrator Pi-hole deployments face lower immediate risk than multi-user configurations or managed service scenarios. The SSVC framework assessment would likely categorize this as 'attend' priority rather than 'immediate' given the authentication prerequisite, though organizations using Pi-hole in production network infrastructure should prioritize patching due to the complete system compromise potential.

An attacker who has obtained valid Pi-hole administrative credentials through phishing or password reuse accesses the web interface and navigates to the DHCP configuration settings. They add a malicious DHCP host entry containing an embedded newline character followed by a dnsmasq directive such as 'dhcp-script=/tmp/payload.sh' where payload.sh contains a reverse shell or credential harvesting script. When FTL processes this configuration and reloads dnsmasq, the injected directive executes the attacker's script with elevated privileges, granting complete system control. The attacker then establishes persistence, exfiltrates DNS query logs containing network intelligence, and potentially pivots to other network segments using the compromised Pi-hole as a foothold in the infrastructure.