An authenticated remote code execution vulnerability in the Pi-hole FTL engine poses a critical risk to system integrity and security.

The FTL engine fails to properly sanitize input in the dhcp.hosts configuration parameter, allowing an authenticated attacker to inject CRLF sequences and arbitrary dnsmasq directives to achieve OS command execution.

The ability for an authenticated attacker to execute arbitrary commands on the underlying system represents a total compromise of the host. Given the CVSS score of 8.8, this vulnerability presents a high risk of unauthorized data access, lateral movement within the network, and potential full system takeover.

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system logs for suspicious dnsmasq configuration changes or unexpected command execution patterns originating from the FTL service.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted users only, and employ network segmentation to limit the impact of a potential compromise.

Public Exploit Available: Unknown.

This vulnerability is severe because it allows for full system control by an authenticated user. Organizations utilizing Pi-hole FTL versions 6.0 through 6.5 must prioritize upgrading to version 6.6 immediately to eliminate the risk of command injection.