{"id":"CVE-2021-33358","details":"Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the \"interface\", \"ssid\" and \"wpa_passphrase\" POST parameters in /hostapd, when the parameter values contain special characters such as \";\" or \"$()\" which enables an authenticated attacker to execute arbitrary OS commands.","modified":"2026-08-07T17:02:12.591928Z","published":"2021-06-09T18:15:08.710Z","references":[{"type":"ADVISORY","url":"https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf"},{"type":"EVIDENCE","url":"https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.php"},{"type":"EVIDENCE","url":"https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.php"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/raspap/raspap-webgui","events":[{"introduced":"a4c594beffb1d4b6252d40cab56028e847798b47"},{"last_affected":"6d3966dd8a54dad2b85b39f2ab0fa476143f2059"}],"database_specific":{"extracted_events":[{"introduced":"2.3"},{"last_affected":"2.6.5"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*"}}],"versions":["2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6","2.6-beta","2.5.2","2.5.1","2.5","2.4.1","2.4-beta","2.4","2.3.1","2.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33358.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}