CVE-2023-27100

CVSS 9.8 CRITICALEPSS 9.8%CWE-307

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 5

githubgithub.com/DarokNET/CVE-2023-27100★ 2 githubgithub.com/fabdotnet/CVE-2023-27100★ 0 cve_referencepacketstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.htmlunverified cve_referencepacketstorm.news/files/id/171791unverified exploitdbwww.exploit-db.com/exploits/51352unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc https://packetstorm.news/files/id/171791 https://redmine.pfsense.org/issues/13574