Exploit for CVE-2025-34087 Targets Pi-hole Versions Up to 3.3

## Overview An exploit for CVE-2025-34087 has appeared in the wild. This vulnerability affects Pi-hole versions up to 3.3. It allows authenticated users to execute arbitrary OS commands through the web interface. The issue arises when adding a domain to the allowlist, where the domain parameter is not properly sanitized. ## Technical Details The vulnerability is a command injection flaw. Attackers can append OS commands to the domain string. These commands execute with the privileges of the Pi-hole service user, which can lead to severe system compromises. The issue was present in the legacy AdminLTE interface of Pi-hole. It has been addressed in later versions, but users running outdated software remain at risk. ## Impact The CVSS score for this vulnerability is 9.0, indicating a critical risk. Successful exploitation can lead to unauthorized access and control over the underlying operating system. This could result in data breaches or further exploitation of the affected system. ## Mitigation Defenders should upgrade to the latest version of Pi-hole immediately. Users running versions prior to 3.3 should apply the patch provided by Pi-hole developers. Regularly updating software and monitoring for unusual activity can help mitigate risks associated with this vulnerability.