CVE-2025-14558

Опубликовано: 09 мар. 2026

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.

resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

Ссылки

https://security.freebsd.org/advisories/FreeBSD-SA-25:12.rtsold.asc
Vendor Advisory
https://sploitus.com/exploit?id=MSF:EXPLOIT-FREEBSD-MISC-RTSOLD_DNSSL_CMDINJECT-
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*

cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.06272

Низкий

7.2 High

CVSS3

Дефекты

CWE-20

Связанные уязвимости

GHSA-m67m-4jp2-2c59

CVSS3: 7.2

github

5 месяцев назад

The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

BDU:2026-00013

CVSS3: 8.8

fstec

8 месяцев назад

Уязвимость демонов для обработки Router Solicitation, Router Advertisement в IPv6 rtsol(8), rtsold(8) ядра операционных систем FreeBSD, позволяющая нарушителю выполнить произвольный код