PT-2022-16589 · Openvpn+1 · Openvpn+2

Yutaka Watanabe · Published 2022-03-18 · Updated 2022-04-07 · CVE-2022-24299

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense CE versions prior to 2.6.0 pfSense Plus versions prior to 22.01

Description The issue is related to improper input validation, allowing a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command. This can be done by exploiting the vulnerability in the OpenVPN client or server settings.

Recommendations For pfSense CE versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. For pfSense Plus versions prior to 22.01, update to version 22.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN client or server settings until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-24299

Affected Products

Openvpn

Pfsense Ce

Pfsense Plus

References · 8

• https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24299 · Security Note
• https://jvn.jp/en/jp/JVN87751554/index.html · Patch
• https://osv.dev/vulnerability/CVE-2022-24299 · Vendor Advisory
• https://t.me/cvenotify/28191 · Telegram Post
• https://t.me/cvenotify/28616 · Telegram Post
• https://t.me/cibsecurity/39897 · Telegram Post
• https://t.me/echeloneyes/60 · Telegram Post