PT-2026-24857 · Adguard · Adguardhome
Mandreko
·
Publicado
2026-03-11
·
Atualizado
2026-03-25
·
CVE-2026-32136
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
AdGuard Home and Affected Versions
AdGuard Home versions prior to 0.107.73
Description
AdGuard Home is a network-wide software for blocking ads and tracking. A critical issue exists where an unauthenticated remote attacker can bypass all authentication mechanisms. This is achieved by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by an internal multiplexer that lacks authentication middleware. Consequently, all subsequent HTTP/2 requests on that connection are processed as if they are fully authenticated, regardless of whether any credentials were provided. The root cause lies in the improper placement of the authentication middleware within the HTTP server configuration. Specifically, the authentication middleware is applied at the outer layer but bypassed when the h2c upgrade occurs, as the inner multiplexer does not enforce authentication. An attacker can exploit this to gain full administrative API access, including the ability to read and modify DNS configuration, add malicious filter lists, disable protection, change the admin password, and hijack DNS resolution for all clients on the network. A proof-of-concept (PoC) script demonstrates the bypass using a raw TCP connection with HTTP/2 framing, allowing an attacker to extract DNS query history and device inventory information. The vulnerability is exploitable without any credentials.
Recommendations
Update to version 0.107.73 or later.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Adguardhome