CVE-2023-42326
Published: 14 November 2023
Summary
CVE-2023-42326 is a high-severity Command Injection (CWE-77) vulnerability in Netgate Pfsense. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-42326 is a command injection vulnerability, tracked as CWE-77, that affects Netgate pfSense version 2.7.0. The flaw resides in the interfaces_gif_edit.php and interfaces_gre_edit.php components and permits remote code execution when specially crafted requests are processed.
An attacker with low-privileged network access can send malicious input to the affected endpoints, resulting in arbitrary code execution on the target system. Successful exploitation yields full control over confidentiality, integrity, and availability without requiring user interaction.
Netgate addressed the issue in security advisory pfSense-SA-23_10.webgui.asc, while independent analysis from SonarSource provides additional technical details on the web GUI components involved.
The associated EPSS score has remained consistently high, reaching a peak of 0.8614.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46779
Vulnerability details
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.