An authenticated remote code execution vulnerability in Pi-hole FTL versions 6.0 through 6.5 poses a critical risk to system integrity and host security.

This vulnerability involves OS Command Injection and CRLF Injection within the dns.cnameRecords parameter. An authenticated attacker can inject newline characters to manipulate dnsmasq configuration directives, leading to arbitrary code execution on the underlying host.

Successful exploitation of this vulnerability allows an authenticated attacker to gain full control over the host system. This could lead to unauthorized data access, complete system compromise, or the use of the affected device as a pivot point for further network attacks. With a CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate prioritization.

Immediate Action: Update Pi-hole FTL to version 6.6 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for unusual dnsmasq configuration changes or unexpected process execution patterns originating from the FTL service.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted users only and implement network segmentation to limit the potential reach of an attacker who gains command execution.

Public Exploit Available: No (exploit_available: unknown).

Given the potential for complete system takeover, administrators should move quickly to patch the FTL engine. Verify your current version of Pi-hole FTL and perform the update to 6.6 immediately to eliminate the command injection vector. Failure to address this vulnerability increases the likelihood of unauthorized administrative access and persistent system compromise.