CVE-2023-27100

CVSS 9.8 CRITICALEPSS 9.8%CWE-307

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

n/a · n/a

PoCs públicas encontradas — 5

githubgithub.com/DarokNET/CVE-2023-27100★ 2 githubgithub.com/fabdotnet/CVE-2023-27100★ 0 cve_referencepacketstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.htmlno verificado cve_referencepacketstorm.news/files/id/171791no verificado exploitdbwww.exploit-db.com/exploits/51352no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc https://packetstorm.news/files/id/171791 https://redmine.pfsense.org/issues/13574