CVE-2021-38556

Description

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

How to fix CVE-2021-38556

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/billz/raspap-webgui—no fix listed

Is CVE-2021-38556 being exploited?

Moderate — EPSS is 13.0%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, <= 2.6.6

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-38556
• PATCHgithub.com/RaspAP/raspap-webgui
• WEBgithub.com/RaspAP/raspap-webgui/blob/0e1d652c5e55f812aaf2a5908884e9db179416ee/includes/configure_client.php
• WEBzerosecuritypenetrationtesting.com/?page_id=306