Published: 01/08/2023 Updated: 07/11/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated malicious users to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
raspap raspap

bash script for automated discovery and exploitation of machines with the CVE-2022-39986 vulnerability

RaspAP Hunter RaspAP Hunter is a Bash script designed to scan for RaspAP installations and test them for a specific vulnerability CVE-2022-39986 ____ ___ ____ / __ \ ____ _ _____ ____ / | / __ \ / /_/ // __ `// ___// __ \ / /| | / /_/ / / _, _// /_/ /(__ )/ /_/ // ___ | / ____/ /_/ |_| \__,_//____// ___//_/ |_|/_/ __ _

CWE-77 https://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php http://packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injection.html https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 https://nvd.nist.gov https://github.com/mind2hex/RaspAP_Hunter

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-39986

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect