CVE-2025-53392 - CVE House
Back to Database
Status published Medium CVE-2025-53392

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command"...

Vulnerability Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53392

Credits & Attribution

No credits recorded in the NVD database.

References

More from Netgate

View All →
CVE-2025-34178
Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
Medium 5.1
CVE-2025-34177
Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
Medium 5.1
CVE-2025-34176
Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure
Medium 5.3
CVE-2025-34175
Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting
Medium 5.1
CVE-2025-34174
Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
Medium 5.1

Affected Vendor

Affected Software

pfSense
Vulnerable Versions:
2.8.0

Timeline

Official Publish: June 28th, 2025
Last Modified: June 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-36

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.