Raspberry Pi's vulnerability footprint is concentrated in its single-board computer products—notably the Pi 3 and Pi 4 models and their associated firmware—which are widely embedded in educational, hobbyist, and light industrial deployments. The observed weakness classes center on resource exposure, insecure defaults, and incomplete configuration specification, reflecting the embedded-systems context where firmware and hardware initialization choices propagate across a large installed base. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Raspberrypi over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-38759CRITICAL Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges. | Dec 7, 2021 | 9.8 | 50 | NO | YES |
CVE-2018-18068CRITICAL The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest privilege level in ARM | Apr 4, 2019 | 9.8 | 31 | NO | NO |
CVE-2021-38545MEDIUM Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover | Aug 11, 2021 | 5.9 | 20 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Raspberrypi.
Media articles that mention a CVE ID that affects a product developed by Raspberrypi — matched by CVE ID, not by vendor name.