CVE-2022-24299

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
pfSense	pfSense CE and pfSense Plus	pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01

References

https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.ascMitigation, Patch, Vendor Advisory
https://jvn.jp/en/jp/JVN87751554/index.htmlPatch, Third Party Advisory
https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.ascMitigation, Patch, Vendor Advisory
https://jvn.jp/en/jp/JVN87751554/index.htmlPatch, Third Party Advisory

Timeline

Published: Mar 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24305.4The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versio CVE-2022-243009.8Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta CVE-2022-243016.5In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.CVE-2022-243025.9In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized inf CVE-2022-243039.1Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-243059.8Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.CVE-2022-243069.8Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.CVE-2022-243079.8Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (J CVE-2022-243085.5Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive infor CVE-2022-243098.1A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runt CVE-2022-24318.8The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i CVE-2022-243109.8A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and