PT-2014-6054 · Netgate · Pfsense

Absolomb · Publicado 2014-07-02 · Atualizado 2019-05-30 · CVE-2014-4688

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4

Description The issue allows remote authenticated users to execute arbitrary commands. This can be achieved through various means, including the hostname value to "diag dns.php" in a Create Alias action, the smartmonemail value to "diag smart.php", or the database value to "status rrd graph img.php".

Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files, such as "diag dns.php", "diag smart.php", and "status rrd graph img.php", until a patch is applied. Additionally, restrict the use of the smartmonemail and database variables in the respective API endpoints to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2014-4688

Produtos afetados

Pfsense

Referências · 3

• 🔥 https://exploit-db.com/exploits/43560 · Exploit
• https://pfsense.org/security/advisories/pfSense-SA-14_10.webgui.asc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4688 · Nota de Segurança