CVE-2024-54780: Command Injection
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-54780?
CVE-2024-54780 is considered a high severity vulnerability due to its potential for command injection by authenticated attackers.
How do I fix CVE-2024-54780?
To fix CVE-2024-54780, upgrade to pfSense CE version 2.8.0 or later, or the corresponding version of pfSense Plus.
Which versions are affected by CVE-2024-54780?
CVE-2024-54780 affects Netgate pfSense CE versions prior to 2.8.0 and corresponding pfSense Plus versions.
What is the impact of CVE-2024-54780?
CVE-2024-54780 allows an authenticated attacker to execute arbitrary commands on the system via the OpenVPN management interface.
Is authentication required to exploit CVE-2024-54780?
Yes, an attacker must be authenticated to exploit CVE-2024-54780 through the OpenVPN widget.