CVE-2025-53392

MEDIUM

5.0

Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

Details CVE

Score CVSS v3.15.0

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie6/28/2025

Derniere modification10/15/2025

Sourcenvd

Observations honeypot0

Produits affectes

pfsense:pfsense

Faiblesses (CWE)

CWE-36

References

https://github.com/skraft9/pfsense-security-research(cve@mitre.org)

https://github.com/skraft9/pfsense-security-research(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.