Read the docs
TI-2024-03690 Aliases CVE-2024-3955GHSA-4f92-w438-f484

Arbitrary code execution in CraftBeerPi 4

Priority MEDIUM 51CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01149 67th percentileScored 2026-11-07
Fix Fixed CraftBeerPi 4 (PiBrewing): 4.4.1.a1 (commit 57572c7)cbpi4 (PyPI): 4.4.1.a1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PiBrewingCraftBeerPi 44.0.0.58 (commit 563fae9) to before 4.4.1.a1 (commit 57572c7)4.4.1.a1 (commit 57572c7)Patch availableCNA
—cbpi4 (PyPI)4.0.0.58 to before 4.4.1.a14.4.1.a1Patch availableGHSA-4f92-w438-f484
  • CraftBeerPi 4 VendorPiBrewing Affected 4.0.0.58 (commit 563fae9) to before 4.4.1.a1 (commit 57572c7) Fixed in 4.4.1.a1 (commit 57572c7) Patch available CNA
  • cbpi4 (PyPI) Vendor— Affected 4.0.0.58 to before 4.4.1.a1 Fixed in 4.4.1.a1 Patch available GHSA-4f92-w438-f484

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:pibrewing:craftbeerpi_4:4.0.0.58:*:*:*:*:*:*:*4.0.0.58—PiBrewing
  • cpe:2.3:a:pibrewing:craftbeerpi_4:4.0.0.58:*:*:*:*:*:*:* Versions 4.0.0.58 — ·PiBrewing

Remediation

  • Fix · CNA CraftBeerPi 4 (PiBrewing) Fixed in 4.4.1.a1 (commit 57572c7)
  • Fix · GHSA-4f92-w438-f484 cbpi4 (PyPI) Fixed in 4.4.1.a1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3955
  2. 2026-10-03 Alias added: GHSA-4f92-w438-f484

References

Advisory 3

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences