What’s Vulnerable › Vulnerabilities

CVE-2022-39987

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 37.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-01 · updated 2026-06-17
• Weakness: CWE-77

Description

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.

Affected products

• raspap-webgui: from 2.8.0 through 2.9.2

References

• https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php
• https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
• https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php
• https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2

Get alerted when CVE-2022-39987 or the next vulnerability affects your stack