Описание
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
Ссылки
- Issue Tracking
- Third Party Advisory
- Product
- Third Party Advisory
Уязвимые конфигурации
EPSS
5 Medium
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
EPSS
5 Medium
CVSS3
8.8 High
CVSS3