CVE-2020-8816

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.2

EPSS

78.19%

Published

May 29, 2020

Modified

Nov 10, 2025

CISA Known Exploited Vulnerability

Added: 2021-12-10 · Due: 2022-06-10

Apply updates per vendor instructions.

Public PoC / Exploit (6)

All weaponized →

TrickestTrickest PoC index Exploit-DBPi-hole 4.3.2 - Remote Code Execution (Authenticated)GitHub PoCcybervaca/CVE-2020-8816★11 GitHub PoCAndreyRainchik/CVE-2020-8816★10 GitHub PoCteam0se7en/CVE-2020-8816★6 GitHub PoCmartinsohn/CVE-2020-8816★1

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78CWE-78

Affected Products (1)

pi-hole · pi-holevulnerable

References (15)

http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html

Third Party AdvisoryVDB Entry

https://github.com/pi-hole/AdminLTE/commits/master

PatchThird Party Advisory

https://github.com/pi-hole/AdminLTE/pull/1165

PatchThird Party Advisory

https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3

Release NotesThird Party Advisory

https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/

Broken LinkExploitThird Party Advisory

https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20

Broken LinkPress/Media Coverage

http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html

Third Party AdvisoryVDB Entry

https://github.com/pi-hole/AdminLTE/commits/master

PatchThird Party Advisory

https://github.com/pi-hole/AdminLTE/pull/1165

PatchThird Party Advisory

https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3

Release NotesThird Party Advisory

https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/

Broken LinkExploitThird Party Advisory

https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20

Broken LinkPress/Media Coverage

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs