CVEvulnerability
CVE-2023-27100
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-307
Description
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
Affected configurations
• netgate pfsense plus 22.05.1
• pfsense pfsense 2.6.0
Related
Weakness · CWE (1)
- CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
References
- http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html packetstormsecurity.com
- https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc Vendor Advisory
- https://redmine.pfsense.org/issues/13574 Issue Tracking, Patch, Vendor Advisory
- http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html packetstormsecurity.com
- https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc Vendor Advisory
- https://redmine.pfsense.org/issues/13574 Issue Tracking, Patch, Vendor Advisory
- https://packetstorm.news/files/id/171791 packetstorm.news