CVE-2026-101858

RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 5.1 Medium EPSS 2.5% KEV · Not listed
Description
A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw is located in the WifiManager::writeWpaSupplicant function of RaspAP raspap-webgui. By manipulating the ssid argument, an attacker can inject arbitrary OS commands through the file’s command interface. This form of shell injection allows execution of any system command with the privileges of the web service, making it a serious remote code execution vulnerability.

Affected Systems

The vulnerability affects the RaspAP raspap-webgui component up to version 3.5.5. Any installation running 3.5.5 or earlier is susceptible. The assertion that newer releases are fixed is inferred from the absence of an issue entry for later versions and is not verified in the CVE record.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is 2%, and the vulnerability is not listed in CISA KEV, but an exploit has already been published and can be triggered remotely from the web interface. Because the injection grants full command execution on the host, the potential impact is high, especially if the service runs with elevated privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RaspAP raspap-webgui to a version newer than 3.5.5 where the command injection issue is resolved.
  • Restrict access to the webgui by limiting the service to trusted IP ranges or a VPN, so only authorized users can reach the vulnerable endpoint.
  • Validate and sanitize all SSID inputs before they are passed to the system command; apply input escaping or remove the use of shell execution for this parameter.

Generated by OpenCVE AI on September 30, 2026 at 04:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
First Time appeared Raspap
Raspap raspap-webgui
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:raspap:raspap-webgui:*:*:*:*:*:*:*:*
Vendors & Products Raspap
Raspap raspap-webgui
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 5:27 PM
Reserved
Sep 28, 2026, 3:43 PM

View source JSON

Updated
Sep 29, 2026, 5:27 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 2:16 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 30, 2026, 4:15 AM

JSON