Vulnerability CVE-2022-26019
Published: 2022-03-31

Description:
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

Type:

NVD-CWE-Other

CVSS2 => (AV:N/AC:M/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.5/10
10/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Netgate -> Pfsense 
Netgate -> Pfsense plus 

 References:
https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc
https://jvn.jp/en/jp/JVN87751554/index.html
Copyright 2024, cxsecurity.com

 

Back to Top