CVE-2023-27100

CRITICAL

9.8

Description

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie3/22/2023

Derniere modification2/25/2025

Sourcenvd

Observations honeypot0

Produits affectes

netgate:pfsense_pluspfsense:pfsense

Faiblesses (CWE)

CWE-307CWE-307

References

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html(cve@mitre.org)

https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc(cve@mitre.org)

https://redmine.pfsense.org/issues/13574(cve@mitre.org)

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html(af854a3a-2127-422b-91ae-364da2661108)

https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc(af854a3a-2127-422b-91ae-364da2661108)

https://redmine.pfsense.org/issues/13574(af854a3a-2127-422b-91ae-364da2661108)

https://packetstorm.news/files/id/171791(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.