#VU60833 Code Injection in pfsense - CVE-2021-41282

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60833

#VU60833 Code Injection in pfsense - CVE-2021-41282

Published: February 23, 2022 / Updated: May 12, 2022


Vulnerability identifier: #VU60833
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Green
CVE-ID: CVE-2021-41282
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
pfsense
Software vendor:
Rubicon Communications

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the sed utility. A remote user can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links