CVE-2022-26019 Path traversal in pfSense CE and pfSense Plus

High 8.8 Published 31 Mar 2022 Updated 3 Aug 2024

Remote attackers with NTP GPS settings access can rewrite files via path traversal, leading to arbitrary command execution on pfSense firewalls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-26019?

CVE-2022-26019 is a high-severity path traversal vulnerability in pfSense CE and pfSense Plus, published on 31 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

Weakness: CWE-22

Which versions are affected by CVE-2022-26019?

It affects 2 products.

Products include Netgate Pfsense, Netgate Pfsense Plus.

How do I fix CVE-2022-26019?

No fix has been published for CVE-2022-26019 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-26019 being exploited?

There is no known exploitation of CVE-2022-26019 in the wild and no public exploit code.

Sources

Also known as GHSA-q5q3-h939-p643.