CVE-2023-29975
📋 TL;DR
This vulnerability in pfSense CE 2.6.0 allows attackers to change any user's password without authentication or verification. This affects all pfSense CE 2.6.0 installations, potentially compromising administrative access to network security appliances.
💻 Affected Systems
- pfSense CE
📦 What is this software?
Pfsense by Pfsense
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover where attackers reset administrator passwords, gain full control of the firewall, and pivot to internal networks.
Likely Case
Unauthorized password changes leading to privilege escalation, service disruption, or credential theft for targeted users.
If Mitigated
Limited impact with strong network segmentation, but still represents authentication bypass risk.
🎯 Exploit Status
Exploit requires access to the web interface but no authentication. Simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.0 or later
Vendor Advisory: https://docs.netgate.com/pfsense/en/latest/releases/2-7-0.html
Restart Required: No
Instructions:
1. Backup configuration. 2. Update via System > Update > Update. 3. Apply update. 4. Verify version shows 2.7.0 or later.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to pfSense web interface to trusted IP addresses only.
Navigate to System > Advanced > Admin Access > Restrict Administration Panel to specific IPs
Enable Two-Factor Authentication
allRequire 2FA for all administrative accounts to add extra protection.
Navigate to System > User Manager > Edit User > Two Factor Authentication tab
🧯 If You Can't Patch
- Implement strict network ACLs to limit web interface access to management networks only
- Monitor authentication logs for unexpected password change attempts
🔍 How to Verify
Check if Vulnerable:
Check pfSense version via web interface Dashboard or CLI: cat /etc/versionCheck Version:
cat /etc/versionVerify Fix Applied:
Confirm version is 2.7.0 or later via Dashboard or CLI📡 Detection & Monitoring
Log Indicators:
- Unexpected password change events in /var/log/system.log
- Multiple failed login attempts followed by password reset
Network Indicators:
- HTTP POST requests to password change endpoints from untrusted sources
SIEM Query:
source="pfSense" AND (event_type="password_change" OR uri_path="/index.php?*changepassword*")