PT-2026-44076 · Leiweibau · Pi.Alert
Aslein1413-Sys
·
Publicado
2026-05-27
·
Atualizado
2026-05-27
·
CVE-2026-44888
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes user-supplied numeric config values (e.g., SMTP PORT) directly into
pialert.conf without validation. Since pialert.conf is loaded via Python's exec() every 3–5 minutes by the
background cron process, an attacker can inject arbitrary Python code and achieve unauthenticated OS-level RCE. On
default installations (PIALERT WEB PROTECTION = False), no credentials are required. This vulnerability is fixed in 2026-05-07.
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pi.Alert