Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Webmin allows remote attackers to run code as root

CVE-2024-12828 · published 1 year ago
Summary

Webmin’s web interface can be tricked into running system commands that were not properly checked, letting an attacker who can log in execute their own code with full administrator rights. This could let a malicious user take control of the server. Upgrade Webmin to the latest version or apply the vendor’s security patch to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webmin webmin 2.104
cpe:2.3:a:webmin:webmin:2.104:*:*:*:*:*:*:*
Original advisory text
Webmin CGI Command Injection Remote Code Execution Vulnerability
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
33% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published30 Dec 2024
Updated9 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-12828 · NVD
CVE-2024-12828 · OSV
Track software like this
Free during beta