CVE-2022-39986: Command Injection

Q: What is the severity of CVE-2022-39986?

The severity of CVE-2022-39986 is critical, with a CVSS score of 9.8.

Q: How does the Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 occur?

The Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 occurs when unauthenticated attackers are able to execute arbitrary commands via the `cfg_id` parameter in `/ajax/openvpn/activate_ovpncfg.php` and `/ajax/openvpn/del_ovpncfg.php`.

Q: Who is affected by the Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7?

Any users of RaspAP versions 2.8.0 through 2.8.7 are affected by the Command injection vulnerability.

Q: How can I fix the Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7?

To fix the Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7, it is recommended to update to a version later than 2.8.7, if available.

Q: Where can I find more information about CVE-2022-39986?

You can find more information about CVE-2022-39986 on the NIST National Vulnerability Database (NVD) website.

Published Aug 1, 2023

Updated

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfgid parameter in /ajax/openvpn/activateovpncfg.php and /ajax/openvpn/delovpncfg.php.

Other sources

Affected Software

2 affected componentsFixes available

composer/billz/raspap-webgui>=2.8.0<2.8.8

2.8.8

RaspAP RaspAP>=2.8.0<=2.8.7

Event History

Aug 1, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Advisory Published

03:30 PM

Frequently Asked Questions

What is the severity of CVE-2022-39986?

The severity of CVE-2022-39986 is critical, with a CVSS score of 9.8.

How does the Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 occur?