CVE-2025-14558

Katalog CVE

CVSS 7.2 · High EPSS 6,4%

Kerentanan Improper Input Validation pada freebsd. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

6,4% peluang dieksploitasi; lebih tinggi dari 93,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.freebsd.org/advisories/FreeBSD-SA-25:12.rtsold.asc advisory vendor
• https://sploitus.com/exploit?id=MSF:EXPLOIT-FREEBSD-MISC-RTSOLD_DNSSL_CMDINJECT- exploit · advisory pihak ketiga