{"id":"CVE-2025-14558","aliases":["EUVD-2025-208404","GHSA-m67m-4jp2-2c59"],"status":"published","title":"Remote code execution via ND6 Router Advertisements","description":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.\n\nresolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.06688,"percentile":0.93991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2026-03-09T11:27:27Z","modified":"2026-06-17T08:36:10Z","exploits":[{"source":"exploitdb","id":"EDB-52463","title":"FreeBSD rtsold 15.x - Remote Code Execution via DNSSL","type":"webapps","platform":"multiple","date":"2025-12-25","url":"https://www.exploit-db.com/exploits/52463"},{"source":"metasploit","id":"exploit/freebsd/misc/rtsold_dnssl_cmdinject","title":"FreeBSD rtsold/rtsol DNSSL Command Injection","type":"exploit","platform":"Unix","date":"2025-12-16","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/freebsd/misc/rtsold_dnssl_cmdinject"},{"source":"pocgithub","id":"JohannesLks/CVE-2025-14558","title":"JohannesLks/CVE-2025-14558","date":"2025-12-20","url":"https://github.com/JohannesLks/CVE-2025-14558"},{"source":"pocgithub","id":"rockmelodies/Blackash-CVE-2025-14558","title":"rockmelodies/Blackash-CVE-2025-14558","date":"2025-12-23","url":"https://github.com/rockmelodies/Blackash-CVE-2025-14558"}],"products":[{"vendor":"freebsd","product":"freebsd"}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-25:12.rtsold.asc","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://sploitus.com/exploit?id=MSF:EXPLOIT-FREEBSD-MISC-RTSOLD_DNSSL_CMDINJECT-","tags":["exploit","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14558"},{"url":"https://github.com/advisories/GHSA-m67m-4jp2-2c59"}],"sources":{"cve":[{"id":"CVE-2025-14558","title":"Remote code execution via ND6 Router Advertisements","description":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.\n\nresolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.","status":"published","published":"2026-03-09T11:27:27.275Z","modified":"2026-03-10T03:55:26.148Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-208404","description":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.\n\nresolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.","status":"published","published":"2026-03-09T11:27:27Z","modified":"2026-03-10T03:55:26Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:06.014236Z"}],"ghsa":[{"id":"GHSA-m67m-4jp2-2c59","title":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in...","description":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.\n\nresolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.","status":"published","published":"2026-03-09T12:31:39Z","modified":"2026-03-09T15:30:47Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:06:30.929454Z"}],"nvd":[{"id":"CVE-2025-14558","description":"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.\n\nresolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.","status":"published","published":"2026-03-09T12:16:11.14Z","modified":"2026-06-17T08:36:10.163Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}