Live › vulnerability › CVE-2024-3955
Go to dashboardCraftBeerPi 4 passes the logtime URL parameter of its downloadlog endpoint straight into os.system without validation. An attacker who can send a crafted request can run arbitrary operating system commands on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:25 UTC, 0h before NVD. All times on this page are UTC.
Any deployment of the cbpi4 PyPI package from 4.0.0.58 up to but not including 4.4.1.a1 is exposed, most often Raspberry Pi brewing controllers running the web interface. Installations on versions outside that range, or not reachable over the network, are not affected by this flaw.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cbpi4 | pypi | >= 4.0.0.58, < 4.4.1.a1 | 4.4.1.a1 |
pip show cbpi4 and confirm the installed version is below 4.4.1.a1 and at least 4.0.0.58cbpi4 PyPI package to 4.4.1.a1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).
This page as .md · .json · in your agent: get_signal("CVE-2024-3955")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.