PT-2023-6864 · Netgate · Pfsense

Oskar Zeino-Mahmalat

·

Published

2023-10-31

·

Updated

2023-12-19

·

CVE-2023-42326

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Netgate pfSense version 2.7.0
Description An issue in Netgate pfSense allows a remote attacker to execute arbitrary code via a crafted request to the interfaces gif edit.php and interfaces gre edit.php components. This is due to the lack of measures to neutralize special elements, which can be exploited by a remote attacker to execute arbitrary commands.
Recommendations For Netgate pfSense version 2.7.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the interfaces gif edit.php and interfaces gre edit.php components until a patch is available. Avoid using these components in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2023-07878
CVE-2023-42326

Affected Products

Pfsense