CVE-2022-26019: Path Traversal
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-26019?
CVE-2022-26019 is an improper access control vulnerability in pfSense CE and pfSense Plus, which allows a remote attacker to rewrite existing files on the file system.
What is the severity of CVE-2022-26019?
The severity of CVE-2022-26019 is high (8.8).
Which software versions are affected by CVE-2022-26019?
CVE-2022-26019 affects pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01.
How can a remote attacker exploit CVE-2022-26019?
A remote attacker with the privilege to change NTP GPS settings can exploit CVE-2022-26019 by rewriting existing files on the file system.
Are there any official references for CVE-2022-26019?
Yes, you can find official references for CVE-2022-26019 at the following links: [Netgate pfSense Security Advisory](https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc), [JVN](https://jvn.jp/en/jp/JVN87751554/index.html).