An authenticated remote code execution vulnerability in Pi-hole FTL versions 6.0 through 6.5 poses a critical risk to system integrity and host security.

This vulnerability involves improper neutralization of CRLF sequences and OS command injection within the dns.hostRecord configuration parameter. An authenticated attacker can inject malicious dnsmasq directives to gain full command execution on the host system.

The ability for an authenticated user to execute arbitrary commands leads to a complete compromise of the host server. Given the CVSS score of 8.8, this vulnerability represents a high risk of unauthorized data access, lateral movement within the network, and potential full system takeover, which could result in significant operational disruption and data loss.

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later to incorporate the necessary security patches.

Proactive Monitoring: Review web interface access logs for unusual activity, particularly focusing on interactions with DNS record configuration endpoints.

Compensating Controls: Implement strict access control lists for the Pi-hole management interface and ensure that the service runs with the least privilege necessary to mitigate the impact of potential command execution.

Public Exploit Available: Unknown

Given the potential for complete system compromise via remote code execution, organizations running Pi-hole FTL versions 6.0 through 6.5 must prioritize the update to version 6.6. While the vulnerability requires authentication, the severity of the impact necessitates immediate action to prevent unauthorized command execution and maintain the security of the DNS infrastructure.