CVE-2023-27100

CRITICAL

9.8

Beschreibung

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/22/2023

Zuletzt geandert2/25/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

netgate:pfsense_pluspfsense:pfsense

Schwachen (CWE)

CWE-307CWE-307

Referenzen

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html(cve@mitre.org)

https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc(cve@mitre.org)

https://redmine.pfsense.org/issues/13574(cve@mitre.org)

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html(af854a3a-2127-422b-91ae-364da2661108)

https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc(af854a3a-2127-422b-91ae-364da2661108)

https://redmine.pfsense.org/issues/13574(af854a3a-2127-422b-91ae-364da2661108)

https://packetstorm.news/files/id/171791(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.