#VU84088 OS Command Injection in pfBlocker-NG - CVE-2022-31814

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU84088

#VU84088 OS Command Injection in pfBlocker-NG - CVE-2022-31814

Published: December 12, 2023 / Updated: October 25, 2024


Vulnerability identifier: #VU84088
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2022-31814
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
pfBlocker-NG
Software vendor:
Netgate

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing HTTP Host header. A remote unauthenticated attacker can send a specially crafted HTTP request to the affected system and execute arbitrary OS commands.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links