LiveActive security incident?Get immediate response
CVE Record

CVE-2021-38556: includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

RaspAP 2.6.6 contains a command injection issue in includes/configure_client.php. If an attacker can reach and abuse that functionality, they may execute commands on the host running RaspAP. The public record does not provide CVSS, authentication requirements, a fixed version, or confirmed exploitation.

Executive priority

Prioritize discovery and access restriction now. The vulnerability can lead to command execution, but public evidence is incomplete on exploitation and fixes. Internet-exposed or broadly reachable RaspAP administration interfaces should be treated as higher urgency.

Technical view

CVE-2021-38556 is reported as command injection in RaspAP 2.6.6 within includes/configure_client.php. The CVE description states attackers can execute commands. The source bundle does not identify CWE, scoring, exploit maturity, required privileges, vulnerable parameter details, or remediation version.

Likely exposure

Exposure is most likely limited to environments running RaspAP 2.6.6, especially where the web GUI or configure-client functionality is reachable. The bundle lists no CPEs or broader affected-version range, so do not assume other versions are affected without vendor confirmation.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. A third-party reference is listed, but the provided data does not include exploit reliability, prerequisites, or observed attacks. Treat this as serious because command execution is claimed, not because exploitation is confirmed.

Researcher notes

The record is sparse: no CVSS, CWE, CPE, affected-version range, authentication context, parameter details, or patch reference. Analysis should stay anchored to RaspAP 2.6.6 and the named PHP file unless additional vendor or maintainer evidence is obtained.

Mitigation direction

  • Identify any RaspAP 2.6.6 instances in managed environments.
  • Restrict RaspAP web GUI access to trusted administration networks.
  • Check RaspAP project guidance for fixed versions or official mitigation.
  • Upgrade only to a vendor-confirmed fixed release when identified.
  • Monitor affected hosts for suspicious web and system activity.

Validation and detection

  • Confirm whether deployed RaspAP version is 2.6.6.
  • Verify whether includes/configure_client.php exists in deployed builds.
  • Review exposure of the RaspAP web interface from untrusted networks.
  • Check web logs for unusual configure-client access patterns.
  • Document vendor guidance used to close the finding.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-38556 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.