High severity · published May 14, 2025
CVE-2024-54780
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of…
8.8
CVSS
12.7%
EPSS
No
On KEV
Description
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Pfsense CE · Netgate
before 2.8.0 · source: NVD
PP
Pfsense Plus · Netgate
before 25.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-54780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-54780
Exploit
https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/
Patch
https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2
More from Pfsense CE
8.8
CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
8.5
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an…
7.5
CVE-2026-111224
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
7.2
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
7.2
CVE-2026-111229
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync