CVE-2025-50428
Published: 27 August 2025
Summary
CVE-2025-50428 is a critical-severity Command Injection (CWE-77) vulnerability in Raspap Raspap-Webgui. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability tracked as CVE-2025-50428 exists in the includes/hostapd.php script. The issue stems from improper sanitization of user input supplied through the interface parameter and carries a CVSS 3.1 score of 9.8 reflecting network-accessible attack complexity that is low with no required privileges or user interaction.
An unauthenticated attacker can supply a crafted interface value over the network to execute arbitrary commands on the host, resulting in complete loss of confidentiality, integrity, and availability on the affected system.
Public references include a detailed analysis at blog.smarttecs.com and a GitHub pull request that addresses the flaw in the raspap-webgui repository. The associated EPSS score remains flat at 0.0384 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28371
Vulnerability details
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated OS command injection in the web interface allows arbitrary Unix shell command execution on the Linux host via unsanitized 'interface' parameter used in exec and shell_exec calls.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the command injection vulnerability by requiring validation and sanitization of user-supplied inputs like the unsanitized 'interface' parameter in hostapd.php.
Mitigates the flaw through timely remediation by applying the available patch from GitHub pull request #1833 to eliminate the improper sanitization issue.
Provides additional protection against command injection by restricting information inputs to approved types, lengths, and formats, complementing sanitization efforts.