CVE-2023-48123
Netgate Pfsense ≤ 2.7.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-48123 is a high-severity an unspecified weakness vulnerability in Netgate Pfsense. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-48123 is an arbitrary code execution vulnerability in the web interface of Netgate pfSense Plus versions 23.05.1 and earlier as well as pfSense CE 2.7.0. The flaw resides in packet_capture.php and can be triggered by sending a specially crafted request to that endpoint.
An authenticated remote attacker with low privileges can exploit the issue over the network without user interaction, achieving full code execution that yields high impacts on confidentiality, integrity, and availability.
Netgate published advisory pfSense-SA-23_11.webgui and a corresponding code commit that addresses the flaw; administrators are advised to apply the update or the referenced patch.
The EPSS score has remained at 0.6825 since disclosure with no material upward movement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-52203
Vulnerability Data
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.