CVE-2022-39986: RaspAP unauthenticated command injection in OpenVPN config AJAX endpoints

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a 9.8 CVSS score and near-maximum EPSS probability makes this an urgent patch-or-isolate case.

What it is

RaspAP 2.8.0 through 2.8.7 passes the cfg_id parameter unsanitized into shell commands in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php, allowing command injection. Because the endpoints are reachable without authentication, any network-adjacent attacker can run arbitrary commands on the device.

Impact

An attacker gains arbitrary command execution with the privileges of the web server, which on RaspAP deployments typically means full control of the underlying Raspberry Pi and any network traffic it routes.

Attack surface

Reached over the network via HTTP requests to the two AJAX endpoints with a crafted cfg_id parameter; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.99034, 99.93rd percentile), indicating strong likelihood of exploitation; public proof-of-concept material is referenced via Packet Storm.

What to do

• Upgrade RaspAP past 2.8.7 to a version where cfg_id is validated or parameterized; verify the fix in the vendor repository before relying on it.
• If immediate upgrade is not possible, restrict access to the /ajax/openvpn/ endpoints and the RaspAP web interface to trusted management networks only.
• Place the RaspAP interface behind authentication at a reverse proxy and block direct access to the AJAX paths from untrusted networks.
• Monitor RaspAP releases and advisories for a confirmed patched version, since the record does not name one.
• Run the RaspAP service with least privilege and isolate the device on a segmented network to limit post-exploitation reach.

Detection

• Inspect web server and proxy logs for requests to /ajax/openvpn/activate_ovpncfg.php or /ajax/openvpn/del_ovpncfg.php containing shell metacharacters in cfg_id.
• Alert on unexpected child processes spawned by the web server user (for example shell, curl, wget, nc) on RaspAP hosts.
• Monitor for outbound connections or new listening services originating from the RaspAP device that are inconsistent with its normal routing role.
• Audit file integrity of RaspAP web files and cron or startup entries for changes following suspicious AJAX requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.