CVE-2024-54780
Published: 14 May 2025
Summary
CVE-2024-54780 is a high-severity Code Injection (CWE-94) vulnerability in Netgate Pfsense Ce. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Netgate pfSense CE versions prior to the 2.8.0 beta release and the corresponding Plus builds contain a command injection vulnerability in the OpenVPN widget. The flaw arises from improper sanitization of user-supplied input to the OpenVPN management interface, allowing arbitrary commands to be passed via the remipp parameter and falling under CWE-94. The issue carries a CVSS 3.1 score of 8.8 with a network attack vector and low complexity.
An authenticated attacker can exploit the weakness remotely by submitting crafted input through the affected widget, resulting in execution of arbitrary OpenVPN management commands that may fully compromise confidentiality, integrity, and availability on the target system.
The Netgate advisory at the provided reference URL outlines important security updates released for pfSense Plus 24.11 and CE 2.7.2, while the accompanying technical blog post examines the command injection path in conjunction with related XSS issues that can lead to cloud hijacking.
The associated EPSS score rose from a low baseline to a recorded peak of 0.0805, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15584
Vulnerability details
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability…
more
by injecting arbitrary OpenVPN management commands via the remipp parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.