Description
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

The flaw lies in the addSudoers method of the PluginInstaller component, which incorrectly modifies the system sudoers file. This improper privilege management allows an attacker to grant themselves or others elevated rights without proper authentication. The impact is that a compromised RaspAP web interface can lead to full root access on the underlying device, compromising confidentiality, integrity, and availability.

Affected Systems

RaspAP raspap-webgui versions up to 3.5.5 are vulnerable. Any installation of the web GUI component that uses the sudo Configuration plugin is at risk, irrespective of the device’s platform as long as the plugin is active.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is considered high severity. The exploit is publicly available and can be launched remotely against the web interface. EPSS data is not available, but the public exploit implies a tangible threat. The vulnerability is not listed in the CISA KEV catalog, yet the remote initiation vector and high score warrant urgent attention.

Generated by OpenCVE AI on September 29, 2026 at 03:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Retain only the newest RaspAP version that has addressed the issue; if unavailable, monitor the vendor for an update and apply immediately.
  • If an update cannot be applied, disable the sudo Configuration plugin in the web GUI or remove it entirely to block privilege escalation paths.
  • Restrict network access to the RaspAP web interface, ideally limiting it to localhost or a trusted VPN, to reduce exposure to remote attackers.

Generated by OpenCVE AI on September 29, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
First Time appeared Raspap
Raspap raspap-webgui
Weaknesses CWE-266
CWE-269
CPEs cpe:2.3:a:raspap:raspap-webgui:*:*:*:*:*:*:*:*
Vendors & Products Raspap
Raspap raspap-webgui
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Raspap Raspap-webgui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T10:44:14.248Z

Reserved: 2026-09-28T15:43:32.708Z

Link: CVE-2026-101860

cve-icon Vulnrichment

Updated: 2026-09-29T10:43:52.991Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T02:16:54.787

Modified: 2026-09-29T18:57:24.350

Link: CVE-2026-101860

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T07:00:08Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management