What is CVE-2022-39986?

CVE-2022-39986 is a vulnerability in N/a. Published 2023-08-01.

Is CVE-2022-39986 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2022-39986

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

EPSS: 0.931 (99.8th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

Public proof-of-concept exploits

mind2hex/CVE-2022-39986-RaspAP-2.8.0-2.8.7-RCE
rapid7/metasploit-framework
getdrive/PoC
mind2hex/CVE-2022-39986
mind2hex/RaspAP_
mind2hex/gitbook_
nomi-sec/PoC-in-GitHub
tucommenceapousser/RaspAP-CVE-2022-39986-PoC
WhiteOwl-Pub/RaspAP-CVE-2022-39986-PoC

References

github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php
medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injec…

Frequently asked questions

What is CVE-2022-39986?: CVE-2022-39986 is a vulnerability in N/a. Published 2023-08-01.
Is CVE-2022-39986 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.