CVE-2022-31814

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 91.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-05 · updated 2026-06-17
Weakness: CWE-78

Description

pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.

Affected products

Netgate Pfblockerng: through 2.1.4_26

References

http://packetstormsecurity.com/files/168743/pfSense-pfBlockerNG-2.1.4_26-Shell-Upload.html
http://packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html
https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
https://github.com/pfsense/FreeBSD-ports/pull/1169
https://github.com/pfsense/FreeBSD-ports/pull/1169/commits/071bdcf2d918c3e51cde11cf81fbd9b6f0379d7e
https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/
http://packetstormsecurity.com/files/168743/pfSense-pfBlockerNG-2.1.4_26-Shell-Upload.html
http://packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html
https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
https://github.com/pfsense/FreeBSD-ports/pull/1169
https://github.com/pfsense/FreeBSD-ports/pull/1169/commits/071bdcf2d918c3e51cde11cf81fbd9b6f0379d7e
https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/

Get alerted when CVE-2022-31814 or the next vulnerability affects your stack