PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44887 leiweibau CVE debrief

Pi.Alert, a WIFI/LAN intruder detector with web service monitoring, contains a critical unauthenticated Remote Code Execution vulnerability in versions prior to 2026-05-07. The web-based configuration editor permits arbitrary Python code injection into pialert.conf, which the background scan daemon subsequently executes via Python's exec() function. With web protection disabled by default, no authentication is required to exploit this vulnerability. The issue was resolved in the 2026-05-07 release. This vulnerability carries a CVSS 3.1 score of 9.8 (Critical) and is classified under CWE-94 (Improper Control of Generation of Code).

Vendor
leiweibau
Product
Pi.Alert
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Organizations running Pi.Alert for network intrusion detection; security teams managing unauthenticated network monitoring tools; administrators of home lab or small business network security infrastructure

Technical summary

The vulnerability exists in Pi.Alert's web-based configuration editor, which fails to sanitize user input before writing to pialert.conf. The background scan daemon loads this configuration file using Python's exec() function, causing any injected Python code to execute with daemon privileges. Default installations have web protection disabled, removing authentication requirements. Attackers can achieve full system compromise without credentials. The fix in 2026-05-07 addresses the input validation gap and/or execution mechanism.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Pi.Alert to version 2026-05-07 or later immediately
  • Enable web protection authentication if not already configured post-upgrade
  • Review pialert.conf for unauthorized modifications or injected code
  • Restrict network access to Pi.Alert web interface to trusted administrative hosts
  • Monitor daemon process execution for anomalous Python code activity
  • Implement file integrity monitoring on pialert.conf to detect unauthorized changes

Evidence notes

Vulnerability description confirms code injection into configuration file with subsequent execution via exec(). Default configuration lacks web protection, enabling unauthenticated exploitation. Fix version 2026-05-07 explicitly stated. CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms network-accessible, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact.

Official resources

2026-05-27