An authenticated remote code execution vulnerability in Pi-hole FTLDNS allows attackers to achieve full system compromise through malicious DHCP configuration injection.

This is an OS command injection vulnerability (CWE-78) facilitated by CRLF injection (CWE-93). An authenticated attacker can inject arbitrary dnsmasq configuration directives into the dhcp.leaseTime parameter, leading to remote command execution on the host system.

The ability for an attacker to execute arbitrary commands on the system hosting Pi-hole poses a severe risk to network infrastructure integrity. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could lead to unauthorized access to internal network traffic, persistent backdoors, or complete compromise of the DNS service.

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later immediately to neutralize the injection vector.

Proactive Monitoring: Review system logs for unusual dnsmasq configuration changes or unexpected process execution patterns initiated by the FTL user account.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted management IP addresses only, and ensure the service runs with the least privilege necessary to limit potential damage.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the security of your network infrastructure. Administrators should prioritize updating the Pi-hole FTL engine to version 6.6 to eliminate the underlying injection flaw. Failure to patch may allow an attacker with standard administrative credentials to escalate their privileges to full system control.