CVE-2025-53392

MEDIUM

5.0

Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

CVE Details

CVSS v3.1 Score5.0

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published6/28/2025

Last Modified10/15/2025

Sourcenvd

Honeypot Sightings0

Affected Products

pfsense:pfsense

Weaknesses (CWE)

CWE-36

References

https://github.com/skraft9/pfsense-security-research(cve@mitre.org)

https://github.com/skraft9/pfsense-security-research(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.