CVE-2020-8816: Pi-Hole AdminLTE Remote Code Execution Vulnerability

EPSS trend

Probability

78.19%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 78.19% on 21-09-2026

21-09-202621-10-2026

EPSS score

78.19%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 10-12-2021
Federal due date: 10-06-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-8816

Public exploits

3 found

referenceUnverified
Exploit Reference (natedotred.wordpress.com)
Maturity: unknown
exploit-databasepythonUnverified
Pi-hole 4.3.2 - Remote Code Execution (Authenticated)
Maturity: poc
MetasploitremoteVerified
Pi-Hole DHCP MAC OS Command Execution
exploit/unix/http/pihole_dhcp_mac_exec
Maturity: weaponized

References

8 links

github.com/pi-hole/AdminLTE/commits/masterX Refsource MISCPatchThird Party Advisory
packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.htmlX Refsource CONFIRMThird Party AdvisoryVDB Entry
natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/X Refsource MISCBroken LinkExploitThird Party Advisory
twitter.com/Nate_Kappa/status/1243900213665902592?s=20X Refsource MISCBroken LinkPress/Media Coverage
github.com/pi-hole/AdminLTE/releases/tag/v4.3.3X Refsource MISCRelease NotesThird Party Advisory
github.com/pi-hole/AdminLTE/pull/1165X Refsource MISCPatchThird Party Advisory
packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.htmlX Refsource MISCThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8816Government ResourceUS Government Resource

Related vulnerabilities

CVE-2021-29448pi-holeadminlte+30.67%5y ago15-04-2021 15:25Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.CVE-2021-29449pi-holepi-hole1.85%5y ago14-04-2021 22:05Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.CVE-2021-32793pi-holeadminlte+10.79%5y ago04-08-2021 17:55Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.CVE-2021-32706pi-holeadminlte+160.18%5y ago04-08-2021 17:50Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.CVE-2025-34087pi-hole llcweb+16.88%1y ago03-07-2025 19:46An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.CVE-2020-11108pi-holepi-hole78.26%6y ago11-05-2020 14:42The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.

All vulnerabilities inpi-hole

CVE-2020-8816: Pi-Hole AdminLTE Remote Code Execution Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References