CVE-2024-44069

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 6

Description The issue allows unauthenticated calls to "admin/api.php?setTempUnit=" to change the temperature units of the web dashboard. The supplier reportedly does not consider this a security issue, but the motivation for allowing arbitrary persons to change the value, which can be seen by the device owner, is unclear.

Recommendations For versions prior to 6, update to version 6 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin/api.php?setTempUnit=" endpoint until a patch is available.