PT-2014-6054 · Netgate · Pfsense

Absolomb · Published 2014-07-02 · Updated 2019-05-30 · CVE-2014-4688

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4

Description The issue allows remote authenticated users to execute arbitrary commands. This can be achieved through various means, including the hostname value to "diag dns.php" in a Create Alias action, the smartmonemail value to "diag smart.php", or the database value to "status rrd graph img.php".

Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files, such as "diag dns.php", "diag smart.php", and "status rrd graph img.php", until a patch is applied. Additionally, restrict the use of the smartmonemail and database variables in the respective API endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2014-4688

Affected Products

Pfsense

References · 3

• 🔥 https://exploit-db.com/exploits/43560 · Exploit
• https://pfsense.org/security/advisories/pfSense-SA-14_10.webgui.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4688 · Security Note