CVE-2021-38557

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-24 · updated 2026-06-17
Weakness: CWE-732

Description

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.

Affected products

raspap-webgui: 2.6.6

References

https://github.com/RaspAP/raspap-webgui
https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/raspap.sudoers
https://zerosecuritypenetrationtesting.com/?page_id=306
https://github.com/RaspAP/raspap-webgui
https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/raspap.sudoers
https://zerosecuritypenetrationtesting.com/?page_id=306

Get alerted when CVE-2021-38557 or the next vulnerability affects your stack