Read the docs
TI-2026-32762 Aliases CVE-2026-44887

Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)

Priority MEDIUM 50CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00545 45th percentileScored 2026-11-07
Fix Fixed Pi.Alert (leiweibau): 2026-05-07

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leiweibauPi.Alertbefore 2026-05-072026-05-07Patch availableCNA
  • Pi.Alert Vendorleiweibau Affected before 2026-05-07 Fixed in 2026-05-07 Patch available CNA

Remediation

  • Fix · CNA Pi.Alert (leiweibau) Fixed in 2026-05-07

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44887
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 1

  • TI-2026-32763 Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger) CVSS 3.1CRITICAL 9.8
  • TI-2026-32761 Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences