Description
A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 5.1 Medium
EPSS: 2.1% Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

The flaw is located in the WifiManager::writeWpaSupplicant function of RaspAP raspap-webgui. By manipulating the ssid argument, an attacker can inject arbitrary OS commands through the file’s command interface. This form of shell injection allows execution of any system command with the privileges of the web service, making it a serious remote code execution vulnerability.

Affected Systems

The vulnerability affects the RaspAP raspap-webgui component up to version 3.5.5. Any installation running 3.5.5 or earlier is susceptible. The assertion that newer releases are fixed is inferred from the absence of an issue entry for later versions and is not verified in the CVE record.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is 2%, and the vulnerability is not listed in CISA KEV, but an exploit has already been published and can be triggered remotely from the web interface. Because the injection grants full command execution on the host, the potential impact is high, especially if the service runs with elevated privileges.

Generated by OpenCVE AI on September 30, 2026 at 04:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RaspAP raspap-webgui to a version newer than 3.5.5 where the command injection issue is resolved.
  • Restrict access to the webgui by limiting the service to trusted IP ranges or a VPN, so only authorized users can reach the vulnerable endpoint.
  • Validate and sanitize all SSID inputs before they are passed to the system command; apply input escaping or remove the use of shell execution for this parameter.

Generated by OpenCVE AI on September 30, 2026 at 04:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
First Time appeared Raspap
Raspap raspap-webgui
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:raspap:raspap-webgui:*:*:*:*:*:*:*:*
Vendors & Products Raspap
Raspap raspap-webgui
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Raspap Raspap-webgui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T17:27:09.184Z

Reserved: 2026-09-28T15:43:24.572Z

Link: CVE-2026-101858

cve-icon Vulnrichment

Updated: 2026-09-29T17:27:01.142Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T02:16:54.417

Modified: 2026-09-29T18:57:24.350

Link: CVE-2026-101858

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:15:08Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')