CVE-2025-53392
📋 TL;DR
This vulnerability in pfSense CE 2.8.0 allows users with the 'WebCfg - Diagnostics: Command' privilege to read arbitrary files through directory traversal in the diag_command.php dlPath parameter. It affects pfSense CE installations where users have been granted this specific diagnostic privilege. The vendor considers this intended behavior for users with this privilege level.
💻 Affected Systems
- Netgate pfSense CE
📦 What is this software?
Pfsense by Pfsense
⚠️ Risk & Real-World Impact
Worst Case
An attacker with the required privilege could read sensitive system files including configuration files, password hashes, SSH keys, and other confidential data, potentially leading to full system compromise.
Likely Case
Authorized users with the diagnostic privilege could inadvertently or intentionally access files outside intended directories, exposing sensitive information.
If Mitigated
With proper privilege separation and access controls, only trusted administrators have the diagnostic privilege, limiting exposure to authorized personnel.
🎯 Exploit Status
Exploitation requires authentication with the specific diagnostic privilege. The vulnerability is directory traversal via dlPath parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as vendor considers this intended behavior. Review and restrict diagnostic privileges as workaround.
🔧 Temporary Workarounds
Restrict Diagnostic Privileges
allReview user accounts and remove 'WebCfg - Diagnostics: Command' privilege from users who don't require it.
Navigate to System > User Manager in pfSense web interface, edit user privileges, and remove 'WebCfg - Diagnostics: Command'
Implement Principle of Least Privilege
allEnsure only essential administrative users have diagnostic command access.
Regularly audit user privileges in System > User Manager
🧯 If You Can't Patch
- Implement strict access controls and limit diagnostic privileges to essential personnel only
- Monitor logs for unusual file access patterns from diagnostic commands
🔍 How to Verify
Check if Vulnerable:
Check if running pfSense CE 2.8.0 and review which users have 'WebCfg - Diagnostics: Command' privilege in System > User Manager.Check Version:
cat /etc/versionVerify Fix Applied:
Verify no unauthorized users have diagnostic privileges and monitor for any directory traversal attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Multiple requests to diag_command.php with directory traversal patterns
Network Indicators:
- HTTP requests to diag_command.php with ../ sequences in parameters
SIEM Query:
source="pfSense-web" AND uri="*diag_command.php*" AND (param="*../*" OR param="*..%2f*")