Summaryinfo

A vulnerability classified as problematic was found in Netgate pfSense CE 2.8.0. This issue affects some unknown processing of the file diag_command.php. Such manipulation of the argument dlPath leads to absolute path traversal. This vulnerability is traded as CVE-2025-53392. The attack may be launched remotely. There is no exploit available. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability was found in Netgate pfSense CE 2.8.0 and classified as problematic. Affected by this issue is an unknown function of the file diag_command.php. The manipulation of the argument dlPath with an unknown input leads to a absolute path traversal vulnerability. Using CWE to declare the problem leads to CWE-36. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. Impacted is confidentiality. CVE summarizes:

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-53392 since 06/28/2025. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

The real existence of this vulnerability is still doubted at the moment. By approaching the search of inurl:diag_command.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19534). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Netgate

Name

• pfSense CE

Version

• 2.8.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion