{"id":"CVE-2020-8816","published":"2020-05-29T19:15:10Z","modified":"2026-06-17T03:26:59Z","title":"Pi-Hole AdminLTE Remote Code Execution Vulnerability","vendor":"Pi-hole","product":"AdminLTE","tier":"core","eol":null,"description":{"text":"Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.","provenance":"source","from":"NVD"},"summary":{"text":"Pi-hole AdminLTE (the web dashboard of Pi-hole, version 4.3.2) contains a flaw that lets a user with privileged dashboard access inject OS command characters through a crafted DHCP static lease entry. An attacker who already holds privileged dashboard credentials over the network can exploit this without any further user interaction to execute arbitrary code on the host.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:10Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.78336,"percentile":0.9958,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-8816","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-12-14","exploitedFirstSeen":"2020-12-14","ransomware":false,"evidence":[{"url":"https://blogs.juniper.net/en-us/threat-research/everything-but-the-kitchen-sink-more-attacks-from-the-gitpaste-12-worm","date":"2020-12-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-10"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/pi-hole/AdminLTE/commits/master","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/pi-hole/AdminLTE/pull/1165","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3","tags":["Release Notes","Third Party Advisory"]},{"url":"https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20","tags":["Broken Link","Press/Media Coverage"]},{"url":"http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/pi-hole/AdminLTE/commits/master","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/pi-hole/AdminLTE/pull/1165","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3","tags":["Release Notes","Third Party Advisory"]},{"url":"https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20","tags":["Broken Link","Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires privileged authenticated dashboard account credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"by privileged dashboard users","start":63,"end":92}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Achieves command execution via crafted DHCP input","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows Remote Code Execution by privileged dashboard users","start":34,"end":92}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-29664","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29664","exploited":true,"exploitedSince":"2021-12-10","provenance":"source"},"exploits":[{"id":48727,"url":"https://www.exploit-db.com/exploits/48727","title":"Pi-hole 4.3.2 - Remote Code Execution (Authenticated)","type":"webapps","platform":"python","date":"2020-08-04","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-08-04"},"pocGithub":{"count":4,"skipped":0,"earliest":"2020-05-10","earliestUrl":"https://github.com/AndreyRainchik/CVE-2020-8816","repos":[{"name":"cybervaca/CVE-2020-8816","url":"https://github.com/cybervaca/CVE-2020-8816","stars":11,"created":"2020-08-04"},{"name":"AndreyRainchik/CVE-2020-8816","url":"https://github.com/AndreyRainchik/CVE-2020-8816","stars":10,"created":"2020-05-10"},{"name":"team0se7en/CVE-2020-8816","url":"https://github.com/team0se7en/CVE-2020-8816","stars":6,"created":"2020-08-06"},{"name":"martinsohn/CVE-2020-8816","url":"https://github.com/martinsohn/CVE-2020-8816","stars":1,"created":"2020-06-15"}]},"metasploit":[{"name":"Pi-Hole DHCP MAC OS Command Execution","module":"exploit/unix/http/pihole_dhcp_mac_exec","type":"exploit","disclosureDate":"2020-03-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb"}],"first":{"date":"2020-03-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb"},"provenance":"source"},"exploitRefs":["https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/","http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html","http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-03-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-05-10, Exploit-DB 2020-08-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb","provenance":"source"},{"date":"2020-05-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8816","provenance":"source"},{"date":"2020-12-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blogs.juniper.net/en-us/threat-research/everything-but-the-kitchen-sink-more-attacks-from-the-gitpaste-12-worm","provenance":"source"},{"date":"2021-12-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29664","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":560},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2147 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 2 NVD exploit links; 4 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}