CVE-2022-40624

Deeper analysis

pfSense pfBlockerNG through version 2.1.4_27 contains an OS command injection vulnerability tracked as CVE-2022-40624 and assigned CWE-78. The flaw resides in the package's handling of the HTTP Host header and permits unauthenticated remote attackers to execute arbitrary operating system commands with root privileges. It carries a CVSS 3.1 base score of 9.8 and is distinct from the earlier CVE-2022-31814 issue affecting the same component.

An attacker with network access to an exposed pfSense instance running the vulnerable pfBlockerNG package can supply a crafted Host header that results in immediate command execution as root. Successful exploitation grants full control of the underlying system, including the ability to modify firewall rules, exfiltrate data, or install persistent malware without requiring authentication or user interaction.

Public references include Netgate's pfBlockerNG documentation and multiple GitHub repositories that publish proof-of-concept exploit code for the issue. The EPSS score reached a peak of 0.9618 and remains at 0.8466, indicating sustained exploitation interest after disclosure.