CVE-2025-14558: Remote code execution via ND6 Router Advertisements

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-09 · updated 2026-06-17
Weakness: CWE-20

Description

The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

Affected products

FreeBSD: 13.5, 13.5-p1, 13.5-p2, 13.5-p3, 13.5-p4, 13.5-p5 (+10)

References

https://security.freebsd.org/advisories/FreeBSD-SA-25:12.rtsold.asc
https://sploitus.com/exploit?id=MSF:EXPLOIT-FREEBSD-MISC-RTSOLD_DNSSL_CMDINJECT-

Get alerted when CVE-2025-14558 or the next vulnerability affects your stack