PT-2023-20955 · Netgate · Pfsense Ce+1

Fabien Maisonnette · Publicado 2023-03-22 · Atualizado 2025-02-25 · CVE-2023-27100

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense Plus software version 22.05.1 pfSense CE software version 2.6.0

Description The issue is related to improper restriction of excessive authentication attempts in the SSHGuard component, allowing attackers to bypass brute force protection mechanisms via crafted web requests.

Recommendations For pfSense Plus software version 22.05.1, update to a version that includes a fix for this issue. For pfSense CE software version 2.6.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the SSHGuard component to minimize the risk of exploitation.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2023-27100

Produtos afetados

Pfsense Ce

Pfsense Plus

Referências · 10

• 🔥 https://exploit-db.com/exploits/51352 · Exploit
• 🔥 https://packetstorm.news/files/id/171791 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27100 · Nota de Segurança
• https://t.me/cibsecurity/60539 · Publicação no Telegram
• https://redmine.pfsense.org/issues/13574 · Aviso do Fabricante
• https://t.me/cvenotify/46685 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27100 · Aviso do Fabricante
• https://t.me/cvenotify/112491 · Publicação no Telegram
• https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc · Aviso do Fabricante
• http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html · Nota