CVE-2024-54780

CVSS 8.8 HIGHEPSS 12.0%CWE-94

Vexday Risk Score

26Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 12.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

14 May 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2