What’s Vulnerable › Vulnerabilities

CVE-2025-53392

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-28 · updated 2026-06-17
• Weakness: CWE-36

Description

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

Affected products

• Netgate pfSense CE: 2.8.0

References

• https://github.com/skraft9/pfsense-security-research
• https://github.com/skraft9/pfsense-security-research

Get alerted when CVE-2025-53392 or the next vulnerability affects your stack