CVE-2021-41282 - CVE House
Back to Database
Status published High CVE-2021-41282

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users...

Vulnerability Description

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41282

Credits & Attribution

No credits recorded in the NVD database.

References

More from pfsense

View All →
CVE-2022-42247
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS)...
Medium 6.1
CVE-2022-40624
pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary...
Unknown 0
CVE-2022-23993
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before...
Medium 6.1
CVE-2021-27933
pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field....
Medium 6.1
CVE-2020-26693
A stored cross-site scripting (XSS) vulnerability was discovered in pfSense...
Medium 5.4

Affected Vendor

Affected Software

pfsense
Vulnerable Versions:
2.5.2

Timeline

Official Publish: March 1st, 2022
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.