CVE-2020-8816

What is Pi-hole?

Pi-hole is a popular open-source, self-hosted DNS sinkhole used to block ads and trackers network-wide, commonly run on a Raspberry Pi or similar small device at home or in a small office. AdminLTE is the web dashboard used to configure Pi-hole, including DHCP settings for the local network.

Overview

CVE-2020-8816 is a remote code execution vulnerability (CWE-78) in Pi-hole's AdminLTE dashboard (version 4.3.2). A privileged dashboard user — someone who already has legitimate access to the Pi-hole web admin panel — can trigger command injection by submitting a crafted DHCP static lease entry (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High). The "High" privileges-required rating reflects that exploitation depends on already having dashboard access, a materially different risk profile from an unauthenticated bug.

Technical Details

The DHCP static lease configuration feature accepts user-supplied values (such as a MAC address or hostname) that are passed into a system-level command without adequate sanitization, allowing an attacker with dashboard access to inject and execute arbitrary shell commands on the underlying device.

Discovery

Publicly tracked via NVD; fixed by the Pi-hole project in a subsequent release of the AdminLTE web interface.

Exploitation Context

CISA added this CVE to KEV in December 2021 based on confirmed exploitation. Because exploitation requires existing dashboard credentials, real-world attacks likely depend on an attacker first obtaining access through weak or default Pi-hole admin passwords, or through a Pi-hole instance whose dashboard was inadvisably exposed to the internet rather than restricted to the local network.

Remediation

1. Update Pi-hole and the AdminLTE web interface to the latest available version immediately.
2. Never expose the Pi-hole admin dashboard to the internet — it should only be reachable from the local trusted network it serves.
3. Use a strong, unique password for the Pi-hole admin dashboard, since this vulnerability's real-world exploitability depends entirely on an attacker first obtaining dashboard access.
4. Audit DHCP static lease entries for unexpected or unfamiliar entries if the dashboard was ever exposed or used a weak password.