Vulnerability in Pfsense

CVE-2021-41282

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parse…

EPSS: 0.871 (99.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Pfsense — versions 2.5.2
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (Third Party Advisory, x_refsource_MISC)
  • cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
  • cve@mitre.org (Third Party Advisory, x_refsource_MISC, Release Notes)
  • cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-41282?
CVE-2021-41282 is a high-severity vulnerability in Pfsense, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2022-03-01.
How severe is CVE-2021-41282?
High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2021-41282 known to be exploited?
5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.