CVE-2025-14558highCWE-20

CVE-2025-14558: high-severity vulnerability in FreeBSD

Remote code execution via ND6 Router Advertisements

Published · Updated

Follow this CVE+ Monitor FreeBSD

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.2epss 6.7%
from disclosure to weaponsame day
Published on NVDMar 9
1st PoCDec 20
metasploitDec 16
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
FreeBSD · FreeBSD
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FreeBSD

In the same product, most dangerous first.

CVE-2018-17157—CVE-2018-17157EPSS 24.2%CVE-2017-1084—CVE-2017-1084EPSS 15.3%CVE-2019-5600—CVE-2019-5600EPSS 4.9%CVE-2018-17158—CVE-2018-17158EPSS 4.4%CVE-2018-6918—CVE-2018-6918EPSS 4.2%CVE-2018-17159—CVE-2018-17159EPSS 4.2%