A vulnerability in Pi-hole versions 6.0.0 through 6.4.2 permits unauthorized ownership management, creating a high risk of privilege escalation and system compromise.

This vulnerability, identified as CWE-282, involves improper ownership management. It requires the attacker to have low-level local privileges to exploit the flaw, potentially resulting in full system impact.

The CVSS score of 8.8 reflects the significant potential for a local attacker to escalate privileges and achieve complete control over the Pi-hole instance. This could lead to unauthorized network monitoring, data exfiltration, or the disabling of security-critical DNS filtering services, resulting in broader operational downtime and loss of network integrity.

Immediate Action: Update Pi-hole to version 6.4.3 or later to apply the necessary security fixes.

Proactive Monitoring: Review system logs for unauthorized configuration changes or attempts to modify sensitive files within the Pi-hole installation directory.

Compensating Controls: Restrict local shell access to the Pi-hole server to authorized administrative personnel only to minimize the risk of a local attacker exploiting this vulnerability.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is substantial due to the potential for full system control. Administrators must prioritize updating to version 6.4.3 immediately to remediate the underlying ownership management issue and prevent unauthorized escalation.