Which versions of Pi.Alert are affected by CVE-2026-44886?

Pi.Alert, a WiFi/LAN network monitoring and intrusion detection tool deployed across many organizations, contains an unauthenticated SQL injection vulnerability in its public devices.php endpoint…. A patch is available.

How to fix or mitigate CVE-2026-44886?

Within 24 hours: Identify all Pi.Alert instances in your environment and document their build dates (vulnerable range: 2024-06-29 through 2026-05-07). Within 7 days: Patch all instances to version 2026-05-07 or later per vendor advisory; if immediate patching is not feasible, implement firewall rules restricting network access to the devices.php endpoint to authorized internal IP ranges only. Within 30 days: Audit database access logs to identify whether unauthorized SQL queries were executed during the vulnerability exposure window and determine what sensitive network or device information may have been disclosed.

Pi.Alert CVE-2026-44886

Q: What is the CVSS score of CVE-2026-44886?

CVE-2026-44886 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-32636 HIGH

SQL Injection (CWE-89)

2026-05-27 GitHub_M

SQLi PHP

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:26 vuln.today

Patch available

May 27, 2026 - 21:04 EUVD

CVSS changed

May 27, 2026 - 20:22 NVD

8.7 (HIGH)

DescriptionGitHub Advisory

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.

AnalysisAI

Unauthenticated SQL injection in Pi.Alert (a WiFi/LAN intruder detection and web-service monitoring tool by leiweibau) lets remote attackers manipulate backend database queries through the public devices.php endpoint. The flaw affects builds from 2024-06-29 up to the 2026-05-07 fix, and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is trivially reachable over the network with no authentication or user interaction, while the high-confidentiality / no-integrity / no-availability impact (VC:H/VI:N/VA:N) indicates the primary risk is database disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided in the source data.

Technical ContextAI

Pi.Alert is a PHP-based network monitoring application (CPE cpe:2.3:a:leiweibau:pi.alert) that tracks devices on a WiFi/LAN and stores results in a backend SQL database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the route /pialert/php/server/devices.php exposes an action handler, and when invoked with the URL parameter action=getDevicesTotals it processes requests without requiring authentication. The value of the scansource URL parameter is concatenated directly into a SQL query rather than being bound as a parameter or sanitized, allowing an attacker to alter the query's logic. Because this code path is intended to return device totals, the underlying query is read-oriented, which aligns with the CVSS confidentiality-only impact.

RemediationAI

Upgrade Pi.Alert to the 2026-05-07 fixed release, which the vendor advisory (GHSA-m929-j7w8-334j) confirms remediates the issue - patch available per vendor advisory. Review that advisory at https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j for upgrade instructions and confirm the installed build is dated 2026-05-07 or later. If immediate patching is not possible, place the Pi.Alert web interface behind authentication via a reverse proxy and restrict network access so only trusted management hosts can reach it (trade-off: breaks any unauthenticated automation or dashboards that rely on direct access); additionally, block or filter external access to the /pialert/php/server/devices.php endpoint at the proxy/WAF layer, and ensure the application is not exposed to the internet - bind it to the internal management network only. These controls reduce the reachable attack surface without altering application logic, but they do not fix the underlying injection, so upgrading remains the only complete remedy.