CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions

published August 24, 2021

CVSS
—
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02224 · 82.6th percentile
Published
2021-08-24T12:33Z
EPSS history
Timeline
  • 24 AUG 12:33Z
    raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions
    cvelistv5