Pi-hole FTL, the core engine of the Pi-hole network-level ad blocker, had a vulnerability (CWE-93) in versions prior to 6.6.1 where the dns.interface configuration field accepted newline characters without validation. This flaw allowed network-adjacent attackers to inject arbitrary directives into the dnsmasq configuration file via the configuration API, which is accessible without credentials if no admin password is set. Exploitation can enable the built-in DHCP server and lead to arbitrary command execution on the host when a DHCP lease is requested. The injected payload is limited to 31 bytes but can include newline characters to inject multiple directives. The vulnerability was addressed in Pi-hole FTL version 6.6.1.

An attacker on the same network can exploit this vulnerability to inject malicious directives into the dnsmasq configuration, enabling the DHCP server and executing arbitrary commands on the host system. This can lead to full system compromise. The vulnerability requires no user interaction and no authentication if the admin password is unset, which is the default in many deployments. The injected payload persists across system restarts, increasing the attack's persistence.

This vulnerability is fixed in Pi-hole FTL version 6.6.1. Users should upgrade to version 6.6.1 or later to remediate this issue. If upgrading immediately is not possible, setting a strong admin password to restrict access to the configuration API can mitigate unauthorized exploitation. Patch status is not explicitly confirmed in the vendor advisory, but the fix is included in version 6.6.1 as stated.