PT-2020-6849 · Unknown · Pi-Hole Web

Nate-Red · Published 2020-03-28 · Updated 2025-11-10 · CVE-2020-8816

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Pi-hole Web version 4.3.2

Description The issue allows remote code execution by privileged dashboard users via a crafted DHCP static lease. This is due to the failure to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For version 4.3.2, update to a version that includes a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the dashboard and limiting the ability to create or modify DHCP static leases until a patch is available.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01047

CVE-2020-8816

Affected Products

Pi-Hole Web

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb · Exploit
• 🔥 https://github.com/AndreyRainchik/CVE-2020-8816 · Exploit
• 🔥 https://github.com/cybervaca/CVE-2020-8816 · Exploit
• 🔥 https://github.com/team0se7en/CVE-2020-8816 · Exploit
• 🔥 https://github.com/martinsohn/CVE-2020-8816 · Exploit
• 🔥 https://github.com/MartinSohn/CVE-2020-8816 · Exploit
• 🔥 https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution · Exploit
• 🔥 https://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48727 · Exploit
• https://github.com/pi-hole/AdminLTE/pull/1165 · Patch
• https://github.com/pi-hole/AdminLTE/commits/master · Patch
• https://osv.dev/vulnerability/CVE-2020-8816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8816 · Security Note
• https://bdu.fstec.ru/vul/2023-01047 · Security Note
• https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3 · Note