CVE-2024-54780

Katalog CVE

CVSS 8.8 · High EPSS 12,7%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada netgate pfsense ce, netgate pfsense plus. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

Rincian

Terbit di NVD

14 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

12,7% peluang dieksploitasi; lebih tinggi dari 96,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2 patch · advisory vendor
• https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/ exploit · advisory pihak ketiga