{"id":"CVE-2023-30260","aliases":["EUVD-2023-1820","GHSA-hhqm-f4m4-pq39"],"status":"published","title":"RaspAP raspap-webgui Command Injection vulnerability","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02484,"percentile":0.84734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2023-06-23T00:00:00Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Packagist","package":"billz/raspap-webgui","fixed_in":["2.8.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"billz/raspap-webgui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"billz/raspap-webgui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9"}]}],"versions":["1.0","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6-beta","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8"]}],"products":[{"vendor":"raspap","product":"raspap"}],"references":[{"url":"https://eldstal.se/advisories/230328-raspap.html","tags":["x_transferred","Exploit","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://github.com/RaspAP/raspap-webgui/pull/1322","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30260","tags":["advisory"]},{"url":"https://github.com/RaspAP/raspap-webgui/commit/238e1670fcef8b18ec4628ee74fc345607536a16","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhqm-f4m4-pq39"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30260.json","tags":["advisory"]},{"url":"https://github.com/RaspAP/raspap-webgui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30260","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T00:00:00Z","modified":"2024-12-05T17:01:02.651Z","updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-1820","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T00:00:00Z","modified":"2024-12-05T17:01:02Z","updated_at":"2026-11-03T00:04:39.661841Z"}],"ghsa":[{"id":"GHSA-hhqm-f4m4-pq39","title":"RaspAP raspap-webgui Command Injection vulnerability","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T12:30:18Z","modified":"2023-11-07T05:01:25Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2023-30260","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T12:15:09.52Z","modified":"2026-06-17T05:54:23.407Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"GHSA-hhqm-f4m4-pq39","title":"RaspAP raspap-webgui Command Injection vulnerability","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T12:30:18Z","modified":"2024-02-16T08:20:34.74016Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"CVE-2023-30260","description":"Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.","status":"published","published":"2023-06-23T00:00:00Z","modified":"2026-10-28T02:31:05.827430205Z","updated_at":"2026-11-02T15:44:31.790231Z"}]}}