UpHeron
All vulnerabilities

Servers and applications

CVE-2024-54780

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

Severity
High 8.8
Published
14 May 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.8.0
Sources
NVD

Affected software

SoftwareAffected versions
pfSenseServers and applications · cpe:a:netgate:pfsense_ce
  • Every version before 2.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-54780
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-54780