Offensive-security research, OSINT investigations, CTF writeups and audit findings. 2026-07-29T09:00:00.000Z https://autoxcyber.com/ https://autoxcyber.com/favicon.svg pondzikcontact@autoxcyber.comhttps://autoxcyber.com/ © 2026 AutoXCyber https://autoxcyber.com/blog/cve-2024-3955-craftbeerpi/ 2026-07-29T09:00:00.000Z 2026-07-29T09:00:00.000Z pondzik

A brewing controller for the Raspberry Pi drops a URL path segment straight into os.system, inside a double-quoted shell string. Command substitution needs no quote to break out — and systemd runs it as root.