This vulnerability affects the raspap-webgui component of RaspAP, specifically the PluginInstaller::addSudoers function in src/RaspAP/Plugins/PluginInstaller.php. Improper handling of sudo configuration allows remote attackers to manipulate privilege settings, leading to improper privilege management. The issue is present in versions 3.5.0 through 3.5.5 inclusive. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor was contacted but did not respond, and no patch or remediation guidance is currently available.

An attacker can remotely exploit this vulnerability to manipulate sudo configuration, potentially gaining elevated privileges on the affected system. This could lead to unauthorized administrative access and control over the device running raspap-webgui. The high CVSS score reflects the critical nature of the privilege escalation risk.

No official patch or remediation is currently available, and the vendor has not responded to disclosure. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting network access to the raspap-webgui interface to trusted users only to reduce exposure. Avoid exposing the vulnerable versions (3.5.0 through 3.5.5) to untrusted networks.