PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44887 leiweibau CVE debrief

Pi.Alert, a WIFI/LAN intruder detector with web service monitoring, contains a critical unauthenticated Remote Code Execution vulnerability in versions prior to 2026-05-07. The web-based configuration editor permits arbitrary Python code injection into pialert.conf, which the background scan daemon subsequently executes via Python's exec() function. With web protection disabled by default, no authentication is required to exploit this vulnerability. The issue was resolved in the 2026-05-07 release. This vulnerability carries a CVSS 3.1 score of 9.8 (Critical) and is classified under CWE-94 (Improper Control of Generation of Code).

Vendor
leiweibau
Product
Pi.Alert
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-29
Advisory published
2026-05-27
Advisory updated
2026-05-29

Who should care

Organizations running Pi.Alert for network intrusion detection; security teams managing unauthenticated network monitoring tools; administrators of home lab or small business network security infrastructure

Technical summary

The vulnerability exists in Pi.Alert's web-based configuration editor, which fails to sanitize user input before writing to pialert.conf. The background scan daemon loads this configuration file using Python's exec() function, causing any injected Python code to execute with daemon privileges. Default installations have web protection disabled, removing authentication requirements. Attackers can achieve full system compromise without credentials. The fix in 2026-05-07 addresses the input validation gap and/or execution mechanism.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Pi.Alert to version 2026-05-07 or later immediately
  • Enable web protection authentication if not already configured post-upgrade
  • Review pialert.conf for unauthorized modifications or injected code
  • Restrict network access to Pi.Alert web interface to trusted administrative hosts
  • Monitor daemon process execution for anomalous Python code activity
  • Implement file integrity monitoring on pialert.conf to detect unauthorized changes

Evidence notes

Vulnerability description confirms code injection into configuration file with subsequent execution via exec(). Default configuration lacks web protection, enabling unauthenticated exploitation. Fix version 2026-05-07 explicitly stated. CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms network-accessible, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44887 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44887

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44887 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44887

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.