{"id":"CVE-2022-31814","aliases":["EUVD-2022-53199","GHSA-hr8v-98c3-7p3x"],"status":"published","title":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as...","description":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.91881,"percentile":0.9982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2022-09-05T00:00:00Z","modified":"2026-06-17T04:46:21Z","exploits":[{"source":"exploitdb","id":"EDB-51032","title":"pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2023-02-20","url":"https://www.exploit-db.com/exploits/51032"},{"source":"metasploit","id":"exploit/unix/http/pfsense_pfblockerng_webshell","title":"pfSense plugin pfBlockerNG unauthenticated RCE as root","type":"exploit","platform":"BSD,Unix","date":"2022-09-05","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_pfblockerng_webshell"},{"source":"nuclei","id":"CVE-2022-31814","title":"pfSense pfBlockerNG \u003c=2.1..4_26 - OS Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31814.yaml"},{"source":"pocgithub","id":"ArunHAtter/CVE-2022-31814","title":"ArunHAtter/CVE-2022-31814","date":"2024-08-12","url":"https://github.com/ArunHAtter/CVE-2022-31814"},{"source":"pocgithub","id":"Chocapikk/CVE-2022-31814","title":"Chocapikk/CVE-2022-31814","date":"2023-03-26","url":"https://github.com/Chocapikk/CVE-2022-31814"},{"source":"pocgithub","id":"EvergreenCartoons/SenselessViolence","title":"EvergreenCartoons/SenselessViolence","date":"2022-09-18","url":"https://github.com/EvergreenCartoons/SenselessViolence"},{"source":"pocgithub","id":"Laburity/CVE-2022-31814","title":"Laburity/CVE-2022-31814","date":"2024-07-23","url":"https://github.com/Laburity/CVE-2022-31814"},{"source":"pocgithub","id":"Madliife0/CVE-2022-31814","title":"Madliife0/CVE-2022-31814","date":"2023-02-22","url":"https://github.com/Madliife0/CVE-2022-31814"},{"source":"pocgithub","id":"TheUnknownSoul/CVE-2022-31814","title":"TheUnknownSoul/CVE-2022-31814","date":"2023-03-01","url":"https://github.com/TheUnknownSoul/CVE-2022-31814"},{"source":"pocgithub","id":"dkstar11q/CVE-2022-31814","title":"dkstar11q/CVE-2022-31814","date":"2023-03-26","url":"https://github.com/dkstar11q/CVE-2022-31814"},{"source":"pocgithub","id":"drcayber/RCE","title":"drcayber/RCE","date":"2023-03-05","url":"https://github.com/drcayber/RCE"},{"source":"pocgithub","id":"sh4den/CVE-2022-31814","title":"sh4den/CVE-2022-31814","date":"2025-01-16","url":"https://github.com/sh4den/CVE-2022-31814"}],"products":[{"vendor":"netgate","product":"pfblockerng"}],"references":[{"url":"https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/168743/pfSense-pfBlockerNG-2.1.4_26-Shell-Upload.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html","tags":["x_transferred"]},{"url":"https://github.com/pfsense/FreeBSD-ports/pull/1169","tags":["x_transferred"]},{"url":"https://github.com/pfsense/FreeBSD-ports/pull/1169/commits/071bdcf2d918c3e51cde11cf81fbd9b6f0379d7e","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31814"},{"url":"https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability"},{"url":"https://github.com/advisories/GHSA-hr8v-98c3-7p3x"}],"sources":{"cve":[{"id":"CVE-2022-31814","description":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.","status":"published","published":"2022-09-05T00:00:00Z","modified":"2024-08-03T07:26:01.3Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-53199","description":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.","status":"published","published":"2022-09-05T00:00:00Z","modified":"2024-08-03T07:26:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:25:32.982782Z"}],"ghsa":[{"id":"GHSA-hr8v-98c3-7p3x","title":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as...","description":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.","status":"published","published":"2022-09-06T00:00:27Z","modified":"2024-07-03T18:32:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:57:33.79017Z"}],"nvd":[{"id":"CVE-2022-31814","description":"pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.","status":"published","published":"2022-09-05T16:15:08.5Z","modified":"2026-06-17T04:46:21.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:26.802986Z"}]}}