Cyber Resilience

CVE-2025-50428

CriticalPublic PoCRCE

Published: 27 August 2025

Published
27 August 2025
Modified
09 September 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0384 88.4th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50428 is a critical-severity Command Injection (CWE-77) vulnerability in Raspap Raspap-Webgui. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 11.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability tracked as CVE-2025-50428 exists in the includes/hostapd.php script. The issue stems from improper sanitization of user input supplied through the interface parameter and carries a CVSS 3.1 score of 9.8 reflecting network-accessible attack complexity that is low with no required privileges or user interaction.

An unauthenticated attacker can supply a crafted interface value over the network to execute arbitrary commands on the host, resulting in complete loss of confidentiality, integrity, and availability on the affected system.

Public references include a detailed analysis at blog.smarttecs.com and a GitHub pull request that addresses the flaw in the raspap-webgui repository. The associated EPSS score remains flat at 0.0384 with no material increase observed after disclosure.

EU & UK References

Vulnerability details

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Authenticated OS command injection in the web interface allows arbitrary Unix shell command execution on the Linux host via unsanitized 'interface' parameter used in exec and shell_exec calls.

CVEs Like This One

CVE-2025-25743Shared CWE-77
CVE-2025-59046Shared CWE-77
CVE-2026-41500Shared CWE-77
CVE-2026-40034Shared CWE-77
CVE-2026-23823Shared CWE-77
CVE-2026-4048Shared CWE-77
CVE-2026-31059Shared CWE-77
CVE-2026-22284Shared CWE-77
CVE-2024-39783Shared CWE-77
CVE-2026-30898Shared CWE-77

Affected Assets

raspap
raspap-webgui
≤ 3.3.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the command injection vulnerability by requiring validation and sanitization of user-supplied inputs like the unsanitized 'interface' parameter in hostapd.php.

prevent

Mitigates the flaw through timely remediation by applying the available patch from GitHub pull request #1833 to eliminate the improper sanitization issue.

prevent

Provides additional protection against command injection by restricting information inputs to approved types, lengths, and formats, complementing sanitization efforts.

References