CVE-2020-8816: Pi-hole Web AdminLTE RCE Vulnerability

CVE-2020-8816 Overview

Pi-hole Web v4.3.2 (aka AdminLTE) contains a command injection vulnerability that allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. This vulnerability affects the Pi-hole administrative interface, enabling authenticated attackers with dashboard access to execute arbitrary commands on the underlying system through malicious MAC address input in the DHCP configuration.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate attention for organizations running vulnerable Pi-hole installations.

Affected Products

• Pi-hole Web (AdminLTE) versions prior to v4.3.3
• Pi-hole Pi-hole installations using vulnerable AdminLTE dashboard
• Systems running Pi-hole v4.3.2 and earlier with DHCP functionality enabled

Discovery Timeline

• May 29, 2020 - CVE-2020-8816 published to NVD
• November 10, 2025 - Last updated in NVD database

Technical Details for CVE-2020-8816

Vulnerability Analysis

CVE-2020-8816 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), representing an OS command injection vulnerability in the Pi-hole web interface. The flaw exists in how the AdminLTE dashboard processes user-supplied MAC address values when creating DHCP static leases.

When a privileged user configures a static DHCP lease through the Pi-hole web interface, the MAC address field is not properly sanitized before being passed to system shell commands. This allows an attacker with authenticated access to the dashboard to inject arbitrary shell commands that execute with the privileges of the web server process.

The vulnerability requires high privileges (authenticated dashboard access), but once achieved, provides complete compromise of confidentiality, integrity, and availability of the target system. Given Pi-hole's role as a network-wide DNS sinkhole, successful exploitation could enable attackers to pivot to other network resources, intercept DNS traffic, or establish persistent access to the network infrastructure.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of MAC address values submitted through the DHCP static lease functionality. The web application fails to properly escape or validate special characters in user input before incorporating them into shell command execution contexts. PHP code processing the DHCP lease configuration directly passes unsanitized MAC address values to system commands, allowing shell metacharacters to break out of the intended command context and execute attacker-controlled commands.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the Pi-hole administrative dashboard. The attack flow proceeds as follows:

1. Attacker authenticates to the Pi-hole web interface (AdminLTE dashboard)
2. Attacker navigates to the DHCP static lease configuration
3. Attacker crafts a malicious MAC address containing embedded shell commands
4. The vulnerable PHP code passes the malicious input to a system command without proper sanitization
5. The injected commands execute with the privileges of the web server process

The exploitation requires no user interaction beyond the initial authentication and can be performed remotely over the network. For detailed exploitation techniques, refer to the Packet Storm OS Command Execution advisory and the Packet Storm Remote Code Execution advisory.

Detection Methods for CVE-2020-8816

Indicators of Compromise

• Unusual MAC address entries in DHCP static lease configuration containing shell metacharacters (;, |, $(), backticks)
• Unexpected process spawning from the web server process (lighttpd/Apache running Pi-hole)
• Anomalous network connections originating from the Pi-hole server
• Modified system files or new unauthorized user accounts on Pi-hole systems
• Web server logs showing POST requests to DHCP configuration endpoints with suspicious payloads

Detection Strategies

• Monitor Pi-hole web server access logs for POST requests to DHCP-related endpoints containing shell special characters
• Implement file integrity monitoring on Pi-hole configuration files and system binaries
• Deploy network-based intrusion detection rules to identify command injection patterns in HTTP traffic to Pi-hole interfaces
• Review authentication logs for unauthorized or anomalous access to the Pi-hole dashboard

Monitoring Recommendations

• Enable verbose logging on Pi-hole web interface and forward logs to centralized SIEM
• Monitor process execution chains for unexpected child processes spawned by the web server
• Implement alerting on any changes to DHCP static lease configurations
• Monitor outbound network connections from Pi-hole servers for command-and-control indicators

How to Mitigate CVE-2020-8816

Immediate Actions Required

• Upgrade Pi-hole AdminLTE to version 4.3.3 or later immediately
• Audit existing DHCP static lease configurations for suspicious MAC address entries
• Review Pi-hole access logs for signs of exploitation
• If exploitation is suspected, isolate the Pi-hole system and perform forensic analysis
• Rotate any credentials that may have been exposed on compromised systems

Patch Information

Pi-hole has addressed this vulnerability in AdminLTE version 4.3.3. The fix implements proper input validation and sanitization for MAC address values in the DHCP static lease functionality. Organizations should update to the patched version by following the official Pi-hole update process. The patch details can be reviewed in the GitHub AdminLTE Pull Request #1165 and the AdminLTE v4.3.3 Release.

Workarounds

• Restrict network access to the Pi-hole administrative interface using firewall rules
• Implement strong authentication and limit dashboard access to trusted administrators only
• Place the Pi-hole management interface behind a VPN or bastion host
• Disable DHCP functionality in Pi-hole if not required and use a separate DHCP server
• Monitor the Pi-hole server for suspicious activity until patching is complete

# Restrict access to Pi-hole admin interface by IP
# Add to lighttpd configuration or firewall rules
sudo iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP

# Update Pi-hole to latest version
pihole -up