CVE-2025-14558
Published: 09 March 2026
Summary
CVE-2025-14558 is a high-severity Improper Input Validation (CWE-20) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is an input validation flaw (CWE-20) in the rtsol(8) and rtsold(8) programs on FreeBSD. These daemons do not sanitize domain search list options received in IPv6 router advertisement messages and forward the raw option body to resolvconf(8). Because resolvconf(8) is an unquoted shell script that performs no input validation, attacker-controlled data can be interpreted as shell commands and executed with the privileges of the resolvconf process.
An attacker able to send crafted router advertisements to a vulnerable FreeBSD host can achieve remote command execution. The CVSS vector indicates network attack reachability with high privileges required, resulting in full compromise of confidentiality, integrity, and availability on the target system.
The referenced FreeBSD security advisory FreeBSD-SA-25:12.rtsold.asc describes the issue and supplies patched versions of rtsol, rtsold, and resolvconf that add proper validation and quoting. A Metasploit module for the command-injection vector is publicly listed.
EPSS scores have reached a peak of 0.6210 with a current value of 0.5542, indicating moderate and sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208404
Vulnerability details
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of…
more
quoting meant that shell commands pass as input to resolvconf(8) may be executed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in network-facing rtsold/rtsol daemon enables remote exploitation for Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like DNSSL options in router advertisements before passing unmodified to vulnerable components such as resolvconf(8).
Enforces restrictions on information inputs at network boundaries to block invalid or malicious DNSSL options from being processed by rtsol(8) and rtsold(8).
Mandates identification, reporting, and correction of the command injection flaw via patches provided in FreeBSD-SA-25:12.rtsold.asc.