CVE-2021-33358

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$()" which enables an authenticated attacker to execute arbitrary OS commands.

• CWE-78

• https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cfThird Party Advisory
• https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.phpExploit, Third Party Advisory
• https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.phpExploit, Third Party Advisory
• https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cfThird Party Advisory
• https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.phpExploit, Third Party Advisory
• https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.phpExploit, Third Party Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33351Cross Site Scripting Vulnerability in Wyomind Help Desk Mage…9
• CVE-2021-33352An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 an…9.8
• CVE-2021-33353Directory Traversal vulnerability in Wyomind Help Desk Magen…9.8
• CVE-2021-33354Directory Traversal vulnerability in htmly before 2.8.1 allo…8.1
• CVE-2021-33356Multiple privilege escalation vulnerabilities in RaspAP 1.5 …8.8
• CVE-2021-33357A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface"…9.8
• CVE-2021-33359A vulnerability exists in gowitness < 2.3.6 that allows an u…7.5
• CVE-2021-3336DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 …8.1
• CVE-2021-33360An issue found in Stoqey gnuplot v.0.0.3 and earlier allows …9.8
• CVE-2021-33361Memory leak in the afra_box_read function in MP4Box in GPAC …5.5
• CVE-2021-33362Stack buffer overflow in the hevc_parse_vps_extension functi…7.8
• CVE-2021-33363Memory leak in the infe_box_read function in MP4Box in GPAC …5.5