Raspberry Pi
Monthly
Improper privilege management in RaspAP WebGUI through 3.5.5 lets an authenticated low-privilege web-UI user escalate to root by manipulating how the plugin installer writes sudo configuration entries through PluginInstaller::addSudoers (src/RaspAP/Plugins/PluginInstaller.php). Exploitation is remote and unauthenticated attempts are not possible - the attacker must already hold a valid RaspAP panel session (CVSS 4.0 PR:L, independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) - but no user interaction or unusual complexity is required beyond that. Publicly available exploit code exists (a GitHub gist demonstration was published alongside the VulDB entry), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis; this is a genuine high-impact issue but not an emergency, with exposure concentrated on panels reachable from untrusted networks or protected only by default credentials.
OS command injection in RaspAP's raspap-webgui (raspap-webgui through version 3.5.5) lets an attacker who already holds a low-privileged authenticated session manipulate the cfg_id parameter of ajax/openvpn/del_ovpncfg.php to inject extra arguments/commands through the incomplete escapeshellcmd() filter. The flaw is remote but requires a valid session (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and because escapeshellcmd only neutralizes shell metacharacters rather than argument boundaries, the realistic outcome is constrained argument injection affecting integrity and availability rather than unrestricted remote code execution. Publicly available exploit code exists (a referenced GitHub gist), but there is no indication of confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Predictable KASLR offsets and RNG seeds in Raspberry Pi 5 and Compute Module 5 EEPROM firmware undermine kernel address space layout randomization across all affected devices and reboots. Because the entropy source is deterministic, any attacker who can identify the firmware version can predict kernel memory addresses, reducing KASLR to a known-offset bypass. This does not itself enable code execution, but it significantly lowers the bar for chaining with any memory-corruption vulnerability targeting these devices. No public exploit code has been identified at time of analysis and this is not listed in the CISA KEV catalog.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper privilege management in RaspAP WebGUI through 3.5.5 lets an authenticated low-privilege web-UI user escalate to root by manipulating how the plugin installer writes sudo configuration entries through PluginInstaller::addSudoers (src/RaspAP/Plugins/PluginInstaller.php). Exploitation is remote and unauthenticated attempts are not possible - the attacker must already hold a valid RaspAP panel session (CVSS 4.0 PR:L, independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) - but no user interaction or unusual complexity is required beyond that. Publicly available exploit code exists (a GitHub gist demonstration was published alongside the VulDB entry), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis; this is a genuine high-impact issue but not an emergency, with exposure concentrated on panels reachable from untrusted networks or protected only by default credentials.
OS command injection in RaspAP's raspap-webgui (raspap-webgui through version 3.5.5) lets an attacker who already holds a low-privileged authenticated session manipulate the cfg_id parameter of ajax/openvpn/del_ovpncfg.php to inject extra arguments/commands through the incomplete escapeshellcmd() filter. The flaw is remote but requires a valid session (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and because escapeshellcmd only neutralizes shell metacharacters rather than argument boundaries, the realistic outcome is constrained argument injection affecting integrity and availability rather than unrestricted remote code execution. Publicly available exploit code exists (a referenced GitHub gist), but there is no indication of confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Predictable KASLR offsets and RNG seeds in Raspberry Pi 5 and Compute Module 5 EEPROM firmware undermine kernel address space layout randomization across all affected devices and reboots. Because the entropy source is deterministic, any attacker who can identify the firmware version can predict kernel memory addresses, reducing KASLR to a known-offset bypass. This does not itself enable code execution, but it significantly lowers the bar for chaining with any memory-corruption vulnerability targeting these devices. No public exploit code has been identified at time of analysis and this is not listed in the CISA KEV catalog.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.