CyberRota Analysis
AI-GeneratedAn OS command injection vulnerability in wg-easy version 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline characters into the client name field. This flaw enables attackers to manipulate the WireGuard configuration file, leading to potential root code execution on the host system. Organizations using wg-easy should prioritize patching this vulnerability to mitigate the risk of unauthorized access and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients.create permission achieves root code execution on the host.