CVE-2025-12490 - CVE House
Back to Database
Status published High CVE-2025-12490

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

Vulnerability Description

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12490

Credits & Attribution

No credits recorded in the NVD database.

Affected Vendor

Affected Software

pfSense
Vulnerable Versions:
pfSense 2.8.1, Suricata package 7.0.8_3

Timeline

Official Publish: November 6th, 2025
Last Modified: November 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)