PT-2026-102428 · Raspap · Raspap-Webgui
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RaspAP raspap-webgui versions prior to 3.5.6
Description
Improper privilege management occurs within the
PluginInstaller::addSudoers() function located in the src/RaspAP/Plugins/PluginInstaller.php file of the sudo Configuration component. This issue allows a remote attacker to perform a manipulation that results in elevated privileges.Recommendations
Update RaspAP raspap-webgui to version 3.5.6 or later.
As a temporary mitigation, restrict access to the
PluginInstaller::addSudoers() function.Exploit
Fix
Improper Privilege Management
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Raspap-Webgui