Lucene search

JpcertCVE-2022-26019

HistoryMar 31, 2022 - 8:15 a.m.

CVE-2022-26019

2022-03-3108:15:08

CWE-22

jpcert

web.nvd.nist.gov

cve-2022-26019

access control

vulnerability

pfsense ce

pfsense plus

ntp

gps

arbitrary command execution

security advisory

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

Affected configurations

Nvd

Vulners

Node

netgatepfsenseRange<2.6.0

netgatepfsense_plusRange<22.01

VendorProductVersionCPE
netgatepfsense*cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*
netgatepfsense_plus*cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgate	pfsense	*	cpe:2.3:a:netgate:pfsense::::::::
netgate	pfsense_plus	*	cpe:2.3:a:netgate:pfsense_plus::::::::

CNA Affected

[
  {
    "product": "pfSense CE and pfSense Plus",
    "vendor": "pfSense",
    "versions": [
      {
        "status": "affected",
        "version": "pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01"
      }
    ]
  }
]

References

docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc

jvn.jp/en/jp/JVN87751554/index.html

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

Related for CVE-2022-26019