Executive brief
Pi.Alert is a network security tool used to monitor WIFI and LAN networks for unauthorized devices. A vulnerability in its web-based configuration editor allows an attacker to take full control of the system by injecting malicious code into the configuration file. Because the software's default settings do not require a password, any remote attacker can exploit this to execute commands with high-level system privileges, potentially leading to a total compromise of the network monitoring device.
Technical details
A code injection vulnerability exists in Pi.Alert's web-based configuration editor due to improper sanitization of user-supplied input in 'front/php/server/files.php'. Specifically, the 'SaveConfigFile' action writes the 'DB_PATH' and 'LOG_PATH' keys to 'pialert.conf' without surrounding quotes. Because the background scan daemon ('back/pialert.py') loads this configuration file using Python's 'exec()' function, any injected Python code is executed in the context of the daemon process, which typically runs with root privileges. Since 'PIALERT_WEB_PROTECTION' is disabled by default, the vulnerability is exploitable by unauthenticated remote attackers. The issue is resolved in the 2026-05-07 update.
Affected products
- leiweibau Pi.Alert Prior to 2026-05-07
Timeline
- 2026-05-07: patched: Vulnerability fixed in version 2026-05-07
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE-2026-44887 published to NVD