PT-2023-22499 · Unknown · Pfsense Ce

Published 2023-11-08 · Updated 2024-09-04 · CVE-2023-29974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pfsense CE version 2.6.0

Description An issue in Pfsense CE allows attackers to compromise user accounts due to weak password requirements.

Recommendations For Pfsense CE version 2.6.0, consider strengthening password requirements to prevent exploitation until a patch is available.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2023-29974

Affected Products

Pfsense Ce

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-29974 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29974 · Vendor Advisory
• https://twitter.com/CVEnew/status/1722350292077814154 · Twitter Post
• https://esecforte.com/cve-2023-29974-weak-password-policy · Note