Servers and applications

CVE-2022-24299

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

Severity: High 8.8
Published: 31 Mar 2022
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 2.6.0
Sources: NVD

Affected software

Software	Affected versions
pfSenseServers and applications · `cpe:a:netgate:pfsense`	Every version before 2.6.0

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24299
CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24299