CVE-2023-27100

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-271026.5Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctxCVE-2023-271038.8Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.CVE-2023-271059.8A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X PortabCVE-2023-271078.8Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 aCVE-2023-271085.3An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log wCVE-2023-27114.8The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privileCVE-2023-271129.8pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php.CVE-2023-271139.8pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php.CVE-2023-271145.5radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.CVE-2023-271155.5WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.CVE-2023-271165.5WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.CVE-2023-271177.8WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.