EUVD-2026-88604
GHSA-675c-v9h6-j3g3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to RaspAP web UI as low-priv user
-
DeliveryTrigger plugin install / addSudoers routine
-
ExploitInject attacker-controlled sudoers entry
-
ExecutionExecute commands as root
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege RaspAP web-UI session (PR:L) and access to the plugin-installer feature, which invokes PluginInstaller::addSudoers to write sudo Configuration entries in src/RaspAP/Plugins/PluginInstaller.php. Exploitation is remote (AV:N) and needs no user interaction (UI:N) and low complexity (AC:L), but is limited by the authentication prerequisite - the attacker must already reach and log into the web panel. No fix is available since the vendor did not respond, so all RaspAP raspap-webgui deployments up to and including 3.5.5 with reachable panels are exposed; impact is greatest where the panel is internet-exposed or protected only by default/weak credentials. |
| Impact | This is a genuine, high-impact issue but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with VC:H/VI:H/VA:H) describes a remotely-reachable, low-complexity privilege-management flaw requiring only low-level authentication (PR:L) and no user interaction, yielding full confidentiality/integrity/availability loss - consistent with a web-admin-to-root escalation. The E:P (Proof-of-Concept) exploit maturity is corroborated by a public PoC gist, so publicly available exploit code exists. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no signal of widespread active exploitation - the risk is 'weaponizable but not yet mass-exploited.' The key limiting factor tempering the 7.4 score is PR:L: the attacker must already hold an authenticated RaspAP web session, which sharply narrows the realistic threat to insiders, credential-theft chains, or internet-exposed panels with weak/default creds. Conflict to note: the source (VulDB) is a single third-party reporter and the vendor did not respond, so affected-version boundaries and the absence of a fix are not independently vendor-confirmed. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to the RaspAP web UI (e.g. a non-admin operator account, stolen session, or an internet-exposed panel with default credentials) invokes the plugin-installer flow, whose PluginInstaller::addSudoers routine writes sudoers entries insecurely, letting the attacker gain command execution as root on the underlying Raspberry Pi host. A public proof-of-concept exploit (gist by 'simyat') is available, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Improper privilege management in RaspAP WebGUI through 3.5.5 lets an authenticated low-privilege web-UI user escalate to root by manipulating how the plugin installer writes sudo configuration entries through PluginInstaller::addSudoers (src/RaspAP/Plugins/PluginInstaller.php). Exploitation is remote and unauthenticated attempts are not possible - the attacker must already hold a valid RaspAP panel session (CVSS 4.0 PR:L, independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) - but no user interaction or unusual complexity is required beyond that. Publicly available exploit code exists (a GitHub gist demonstration was published alongside the VulDB entry), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis; this is a genuine high-impact issue but not an emergency, with exposure concentrated on panels reachable from untrusted networks or protected only by default credentials.
Earlier versions of this analysis (1)
Improper privilege management in RaspAP WebGUI up to and including version 3.5.5 lets an authenticated, low-privileged user who can reach the plugin installation feature abuse PluginInstaller::addSudoers to write attacker-influenced sudo configuration and obtain root-level privileges on the underlying Raspberry Pi host. The issue is remotely exploitable with low complexity and no user interaction, and publicly available exploit code exists (a proof-of-concept gist is linked in the references), so exploitation requires only a valid low-privilege web session rather than any advanced technique. The vendor was contacted but did not respond, so no patched release has been identified and every deployment exposing the plugin installer remains exposed.
RemediationAI
No vendor-released patch identified at time of analysis - the reporter contacted the vendor early but received no response, so there is no confirmed fixed version of RaspAP to upgrade to and the references (https://vuldb.com/vuln/411094, https://vuldb.com/cve/CVE-2026-101860) offer disclosure detail rather than a fix. Until a patched release appears, apply compensating controls in the following priority order and accept their trade-offs: (1) remove the RaspAP panel from untrusted exposure - bind it to localhost or a management VLAN, or front it with a firewall rule or reverse-proxy allowlist so only trusted administration addresses can reach it; this eliminates the remote (AV:N) reachability entirely but requires admins to use a VPN or jump host, and will break any remote-management workflows that depend on public access. (2) Remove or restrict the plugin-installer capability for non-administrative accounts: if plugin installation is not needed, delete the Plugins directory or drop the corresponding routes so PluginInstaller::addSudoers cannot be invoked; the trade-off is loss of plugin functionality until the code is patched. (3) Audit and lock down the sudo configuration on the host - inspect /etc/sudoers.d and any RaspAP-generated rules with visudo -c, remove unexpected NOPASSWD entries, and make the sudoers files root-owned and read-only to the web server user; be aware that tightening these permissions may cause legitimate RaspAP plugin installations to fail. (4) Enforce strong, unique credentials and disable default accounts, and require the panel to be administered only by trusted users, since the vulnerability is only reachable post-authentication (PR:L) - this reduces the attack surface but does not by itself neutralize a malicious insider or a compromised low-privilege account. (5) Monitor for exploitation by alerting on writes to /etc/sudoers.d, on unexpected sudo invocations from the web server user, and on plugin-installation events, and rotate any credentials or keys stored on affected devices if tampering is suspected, since successful exploitation yields root-level control of the underlying Raspberry Pi host and any network it serves.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RaspAP is a PHP web application that turns a Raspberry Pi (or Debian-based host) into a managed wireless access point, hotspot, and network router; its web GUI necessarily holds privileged capabilities to reconfigure hostapd, dnsmasq, and system networking. The vulnerable code path is PluginInstaller::addSudoers in src/RaspAP/Plugins/PluginInstaller.php, part of the plugin-installation component: when a plugin is installed, the application appends sudo-privilege rules to the system sudo configuration (typically under /etc/sudoers.d) on behalf of the web server user. Because the input governing which commands, binaries, or users are granted sudo rights is not adequately validated or constrained, an attacker who can reach the plugin-installer feature can shape those sudoers entries - the root-cause class is CWE-269, Improper Privilege Management, i.e., the application grants privileges it should never grant based on user-controllable data. The affected product is tracked by CPE cpe:2.3:a:raspap:raspap-webgui:*:*:*:*:*:*:*:*, covering RaspAP WebGUI releases up to and including 3.5.5. This is a classic privilege-boundary failure in a management plane that is itself designed to hold root-equivalent power: the web UI's legitimate need to write sudo rules converts any missing authorization or input-sanitization check in that write path directly into local root compromise of the underlying device.
Know when Raspap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remotely reachable low-complexity flaw needing an authenticated low-priv web session (PR:L); insecure sudoers write yields root command execution, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-269 (Improper Privilege Management).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
RaspAP WebGUI versions through 3.5.5 contain a high-severity privilege-escalation vulnerability that allows an authenticated low-privilege panel user to gain root on the underlying device; publicly available exploit code exists, and no vendor-released patch identified at time of analysis. Leadership should care because a limited web-console account could take full control of affected network-management appliances, with risk concentrated on instances reachable from untrusted networks or protected only by default credentials. The root-level impact and public exploit availability warrant prioritized containment, especially where affected panels support critical network operations or are internet-facing.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting RaspAP WebGUI to trusted management networks or VPN, enforcing strong unique credentials and removing default logins, minimizing low-privilege panel accounts, disabling plugin-installer functionality if not required, monitoring and auditing sudoers and plugin-install activity, segmenting affected appliances from untrusted networks, and using WAF/IDS controls to detect exploitation attempts until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in RaspAP raspap-webgui Command Injection and Privilege Escalation
View all 3A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary comma
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. Rated high sev
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in
Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inj
An issue was discovered in includes/webconsole.php in RaspAP 2.5. Rated high severity (CVSS 8.8), this vulnerability is
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical.php of the component HTTP POST Reques
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request. Rat
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attac
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. Rated cr
Exploit-DB