CVE-2022-24299

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

• CWE-20

• https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.ascMitigation, Patch, Vendor Advisory
• https://jvn.jp/en/jp/JVN87751554/index.htmlPatch, Third Party Advisory
• https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.ascMitigation, Patch, Vendor Advisory
• https://jvn.jp/en/jp/JVN87751554/index.htmlPatch, Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24293Certain HP Print devices may be vulnerable to potential info…9.8
• CVE-2022-24294A regular expression used in Apache MXNet (incubating) is vu…7.5
• CVE-2022-24295Okta Advanced Server Access Client for Windows prior to vers…8.8
• CVE-2022-24296Use of a Broken or Risky Cryptographic Algorithm vulnerabili…7.5
• CVE-2022-24297Improper buffer restrictions in firmware for some Intel(R) N…6.7
• CVE-2022-24298All versions of package freeopcua/freeopcua are vulnerable t…7.5
• CVE-2022-2430The Visual Composer Website Builder plugin for WordPress is …5.4
• CVE-2022-24300Minetest before 5.4.0 allows attackers to add or modify arbi…9.8
• CVE-2022-24301In Minetest before 5.4.0, players can add or subtract items …6.5
• CVE-2022-24302In Paramiko before 2.10.1, a race condition (between creatio…5.9
• CVE-2022-24303Pillow before 9.0.1 allows attackers to delete files because…9.1
• CVE-2022-24304Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…