CVE-2022-24299

2022-03-3107:21:07

jpcert

www.cve.org

input validation

pfsense

privilege escalation

remote attacker

arbitrary command

AI Score

Confidence

High

EPSS

0.003

Percentile

71.7%

JSON

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

CNA Affected

[
  {
    "product": "pfSense CE and pfSense Plus",
    "vendor": "pfSense",
    "versions": [
      {
        "status": "affected",
        "version": "pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01"
      }
    ]
  }
]