CVE-2022-31814

Deeper analysis

CVE-2022-31814 is an OS command injection vulnerability, tracked as CWE-78, that affects the pfBlockerNG package in pfSense up through version 2.1.4_26. The flaw permits arbitrary operating-system command execution as root when specially crafted shell metacharacters are supplied in the HTTP Host header; version 3.x of the package is explicitly unaffected.

Unauthenticated remote attackers can exploit the issue over the network without any user interaction or credentials. Successful exploitation grants full root-level control of the affected pfSense system, enabling arbitrary command execution, persistence, or further lateral movement within the environment.

Public references point to a corrective commit merged via the FreeBSD-ports repository and advise users to upgrade pfBlockerNG to a fixed release or migrate to the unaffected 3.x branch. Netgate documentation for pfBlockerNG also directs administrators to apply available package updates through the pfSense interface.

The CVE maintains a very high EPSS score, with a recorded peak of 0.9710 and a current value of 0.9432, and public proof-of-concept exploits have been posted to PacketStorm, indicating active interest in the flaw after disclosure.