CVE-2024-44069 Missing authorization in n/a
Unauthenticated attackers can modify the temperature unit setting on the Pi-hole web dashboard, altering the display for the device owner.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-44069?
CVE-2024-44069 is a high-severity missing authorization vulnerability in n/a, published on 19 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear.
Weakness: CWE-862
Which versions are affected by CVE-2024-44069?
It affects 1 product.
Products include Pi-Hole Pi-Hole.
How do I fix CVE-2024-44069?
No fix has been published for CVE-2024-44069 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-44069 being exploited?
There is no known exploitation of CVE-2024-44069 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-8816 Pi-Hole AdminLTE Remote Code Execution
- CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
- CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
- CVE-2020-11108 File upload in n/a
- CVE-2019-13051 Pi-Hole 4.3 allows Command Injection.
Sources
Also known as GHSA-pqq3-vh29-3h6q.