CVE DATABASE / CVE-2021-41282
CVE-2021-41282
CVSS 8.8 · HIGH
Summary
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
CVSS 3.1 breakdown
| Base score | 8.8 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Pfsense pfsense
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html
- https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html
- https://www.shielder.it/advisories/
- https://www.shielder.it/advisories/pfsense-remote-command-execution/
Data: NIST NVD. NVD last modified 2024-11-21. Always verify against the vendor advisory before acting.