CVE-2020-8816

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

78.19% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-12-10

Published

2020-05-29

Updated

2025-10-21

Proof-of-concept exploits (4)

• AndreyRainchik/CVE-2020-881610★ · 2020-05-10
• MartinSohn/CVE-2020-88161★ · 2022-02-17
• cybervaca/CVE-2020-881611★ · 2020-08-05
• team0se7en/CVE-2020-88166★ · 2020-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48727

References

• CVE Record
• NVD entry

Related

• CVE-2019-16113
• CVE-2020-8811
• CVE-2020-8813
• CVE-2020-8818
• CVE-2020-8812
• CVE-2020-8819