CVE-2022-31814

CRÍTICO 9.8CVE-2022-31814 · Published 05/09/2022 · updated 17/06/2026

En resumen

CVE-2022-31814 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a pfblockerng (netgate).
Probabilidad de explotación en los próximos 30 días (EPSS): 91.9%, mayor que el 99.8% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
pfblockerng netgate	`≤ 2.1.4_26`	No fix yet

Description

pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.

References

packetstormsecurity.com/files/168743/pfSense-pfBlockerNG-2.1.4_26-Shell-Upload.html · Exploit
packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html
docs.netgate.com/pfsense/en/latest/packages/pfblocker.html · Release Notes
pfsense/FreeBSD-ports#1169
pfsense/FreeBSD-ports#1169
ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free