CVE-2021-41282: Command Injection
First published: Tue Mar 01 2022(Updated: )
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pfSense pfSense | =2.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-41282?
CVE-2021-41282 is a vulnerability in pfSense 2.5.2 that allows sed data injection, potentially leading to unauthorized access to sensitive information.
How severe is CVE-2021-41282?
CVE-2021-41282 has a severity rating of 8.8 (critical).
What is the affected software?
The affected software for CVE-2021-41282 is pfSense 2.5.2.
How can I fix CVE-2021-41282?
To fix CVE-2021-41282, update to the latest version of pfSense (2.6.0 or later) as recommended by the vendor.
Are there any additional resources for CVE-2021-41282?
Yes, you can find additional resources at the following links: [http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html](http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html), [https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html](https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html), [https://www.shielder.it/advisories/](https://www.shielder.it/advisories/).
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- vendor/pfsense
- canonical/pfsense pfsense
- version/pfsense pfsense/2.5.2