CVE-2025-53392

6.5 mediumEPSS 1.8%

Medium (6.5) in pfsense pfsense. EPSS 1.8% chance of exploitation in the next 30 days.

In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-36
Published: 2025-06-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pfsense:pfsense

References

https://github.com/skraft9/pfsense-security-research
https://github.com/skraft9/pfsense-security-research

Check your stack JSON