CVE-2020-8816
Pi-Hole AdminLTE Remote Code Execution Vulnerability
Description
CVE-2020-8816 is a high-severity OS command injection vulnerability in Pi-hole AdminLTE, the web-based management interface for the Pi-hole DNS sinkhole. Pi-hole Web v4.3.2 and earlier allows authenticated dashboard users to execute arbitrary operating system commands on the underlying server by crafting a malicious DHCP static lease entry. Although exploitation requires high privileges (dashboard administrator access), the attack is remotely exploitable over the network with low complexity. CISA has added CVE-2020-8816 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 90.78% (99.6th percentile), the probability of active exploitation is extremely high.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| pi-hole | pi-hole | <= 4.3.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://github.com/pi-hole/AdminLTE/commits/master(Patch, Third Party Advisory)
- https://github.com/pi-hole/AdminLTE/pull/1165(Patch, Third Party Advisory)
- https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3(Release Notes, Third Party Advisory)
- https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/(Broken Link, Exploit, Third Party Advisory)
- https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20(Broken Link, Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In the context of Pi-hole AdminLTE, OS command injection occurs because the DHCP static lease functionality constructs system commands using user-supplied input without properly neutralizing shell metacharacters. An authenticated administrator can inject arbitrary OS commands through crafted MAC address or hostname fields in the DHCP lease configuration, which are then executed by the underlying shell with the privileges of the Pi-hole application.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2020-8816 carries a CVSS 3.1 score of 7.2 (HIGH), reflecting a serious but privilege-gated threat. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high privileges (administrative dashboard access) and no user interaction. Successful exploitation results in full compromise of confidentiality, integrity, and availability on the Pi-hole host system, as the attacker gains the ability to execute arbitrary commands. With an EPSS score of 90.78%, this vulnerability is near-certain to be exploited in environments where Pi-hole instances are exposed with weak or default credentials. Organizations running vulnerable Pi-hole deployments should treat this as an urgent patching priority, especially since Pi-hole often runs on devices with broad network visibility.
Exploit Maturity
CVE-2020-8816 has a mature exploit landscape with multiple public proof-of-concept exploits available. Public exploit code is available via Packet Storm Security and a second remote code execution exploit. CISA has confirmed active exploitation in the wild by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-10. The EPSS score of 90.78% indicates near-certain exploitation activity, placing this vulnerability in the top 0.4% of all CVEs by exploitation probability. Federal agencies and organizations following CISA guidance were required to remediate this vulnerability by the specified due date.
Remediation
- Update Pi-hole AdminLTE to version 4.3.3 or later as directed by CISA KEV: Apply updates per vendor instructions. The fix is available in the AdminLTE v4.3.3 release.
- Verify all Pi-hole instances running AdminLTE version 4.3.2 or earlier have been upgraded, paying attention to Docker-based deployments that may use pinned image versions.
- Restrict access to the Pi-hole administrative dashboard by placing it behind a VPN or firewall rules that limit access to trusted management networks only, preventing remote exploitation even if the vulnerability is unpatched.
- Review DHCP static lease configurations and system logs for signs of command injection attempts, such as unexpected characters in MAC address or hostname fields, and investigate any anomalous process execution on the Pi-hole host.
- Implement strong, unique passwords for the Pi-hole admin dashboard and avoid using OS commands with user input in any custom scripts or extensions, following the principle of parameterized execution interfaces that separate commands from arguments.
Technical Details
CVE-2020-8816 exploits an OS command injection flaw in the DHCP static lease functionality of Pi-hole AdminLTE v4.3.2 and earlier. The vulnerability arises because the application constructs operating system commands by directly concatenating user-supplied input from the DHCP lease form fields (such as MAC addresses) into shell command strings without proper sanitization of shell metacharacters. An authenticated administrator can inject commands using characters like semicolons, pipes, or backticks within the MAC address field, which are then executed by the system shell with the privileges of the web server process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that while the attack requires administrative credentials, it is straightforward to execute remotely and results in complete compromise of the host system's confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2020-8816 being actively exploited?
Yes. CVE-2020-8816 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 90.78% (99.6th percentile) indicates an extremely high probability of exploitation, and multiple public exploit tools are readily available.
What products are affected by CVE-2020-8816?
CVE-2020-8816 affects Pi-hole Web (AdminLTE) version 4.3.2 and earlier. All Pi-hole installations running the vulnerable web interface are at risk, including those deployed on Raspberry Pi, Docker containers, and other Linux-based systems.
How do I fix CVE-2020-8816?
Update Pi-hole AdminLTE to version 4.3.3 or later, which patches the command injection vulnerability. Until patching is possible, restrict network access to the Pi-hole dashboard to trusted management IPs only and ensure strong administrator passwords are in use.
How severe is CVE-2020-8816?
CVE-2020-8816 has a CVSS 3.1 score of 7.2 (HIGH). While exploitation requires administrator-level access to the Pi-hole dashboard, the ease of exploitation and the availability of public exploit code make this a critical remediation priority. The 90.78% EPSS score places it among the most likely-to-be-exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.