| Package | Affected versions | Patched versions |
|---|---|---|
| pfsense | ≤ 2.9.0 |
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free