CVE-2020-8816

Pi-Hole AdminLTE Remote Code Execution Vulnerability

Published May 29, 2020 · updated Jun 16, 2026 · pi-hole pi-hole

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Timeline

Detection, updates, and resolution for this record.

May 29, 2020 · Catalog
Detected
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Dec 10, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Apply updates per vendor instructions.

CISA due date Jun 10, 2022

CISA KEVCVE-2020-8816
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
cisa.gov
CVE.orgCVE-2020-8816
Official CVE identifier
cve.org
FIRST EPSSCVE-2020-8816
30-day exploitation probability 78.2%
first.org
Exploit Database48727
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit Modulesexploit_unix/http/pihole_dhcp_mac_exec
Public module reference (good). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2020-8816
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com