CVE-2024-54780: Netgate pfSense CE RCE Vulnerability

CVE-2024-54780 Overview

CVE-2024-54780 is a command injection vulnerability in Netgate pfSense CE and pfSense Plus. The flaw exists in the OpenVPN widget, which fails to sanitize user-supplied input passed to the OpenVPN management interface. An authenticated attacker can inject arbitrary OpenVPN management commands through the remipp parameter. Successful exploitation compromises the confidentiality, integrity, and availability of the firewall appliance. The issue affects pfSense CE releases prior to 2.8.0 beta and corresponding pfSense Plus builds. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated attacker can inject OpenVPN management commands via the remipp parameter, leading to full compromise of the pfSense firewall.

Affected Products

Netgate pfSense CE prior to 2.8.0 beta
Netgate pfSense Plus (corresponding builds prior to 24.11)
Deployments exposing the pfSense web UI with authenticated user access

Discovery Timeline

2025-05-14 - CVE-2024-54780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54780

Vulnerability Analysis

The vulnerability resides in the OpenVPN widget component of the pfSense web interface. The widget accepts a remipp parameter that identifies the remote IP and port used to query the OpenVPN management interface. Input passed to remipp is forwarded to the management socket without adequate sanitization. An attacker who is already authenticated to the web UI can append additional OpenVPN management commands to the parameter value. The management interface then executes each injected command in sequence.

The issue is categorized as command injection under [CWE-94]. Because the OpenVPN management interface exposes commands that interact with the underlying process and configuration, injection extends attacker capabilities beyond the widget's intended read-only function. The EPSS score places this issue in the top percentile of vulnerabilities most likely to see exploitation attempts.

Root Cause

The root cause is improper neutralization of special elements in the remipp parameter before it is passed to the OpenVPN management channel. The application trusts the parameter as a well-formed endpoint identifier. It does not enforce a strict format such as IP:port or reject characters used to delimit management commands.

Attack Vector

Exploitation requires network access to the pfSense web interface and valid authenticated credentials. The attacker submits a crafted request to the OpenVPN widget endpoint with a remipp value that contains an injected OpenVPN management command. The widget forwards the value to the management interface, which processes the additional command. Chaining this issue with a cross-site scripting flaw, as documented by the referenced research, can enable an unauthenticated attacker to trigger the injection through an authenticated administrator's browser session. Full technical analysis is available in the Brillant IT research on exploiting pfSense XSS and command injection.

Detection Methods for CVE-2024-54780

Indicators of Compromise

HTTP requests to the OpenVPN widget containing newline characters, semicolons, or OpenVPN management keywords such as signal, log, or status inside the remipp parameter
Unexpected OpenVPN process restarts, configuration reloads, or client disconnections recorded in openvpn.log
Authenticated web sessions originating from unusual source IP addresses issuing widget refresh requests at high frequency
Outbound connections from the pfSense host that do not match expected management traffic

Detection Strategies

Inspect web server access logs for widgets/widgets/openvpn.widget.php requests where the remipp parameter contains characters outside the expected IP:port grammar
Alert on any change to OpenVPN runtime state that is not correlated with an administrator action in the audit log
Correlate web UI authentication events with subsequent widget requests to identify anomalous session behavior

Monitoring Recommendations

Forward pfSense web UI, authentication, and OpenVPN logs to a centralized logging platform for retention and analysis
Baseline normal OpenVPN management activity and alert on deviations in command frequency or origin
Monitor administrator account usage for logins from new geographies or user agents

How to Mitigate CVE-2024-54780

Immediate Actions Required

Upgrade pfSense CE to 2.7.2 or later and pfSense Plus to 24.11 or later, per the Netgate security advisory
Restrict access to the pfSense web interface to trusted management networks only
Rotate credentials for all administrative and web UI accounts after patching
Review OpenVPN configuration and connected clients for unauthorized changes

Patch Information

Netgate has released fixed builds addressing this vulnerability. pfSense CE 2.7.2 and pfSense Plus 24.11 contain the sanitization fix for the OpenVPN widget. Details are provided in the Netgate Important Security Updates advisory.

Workarounds

Remove or disable the OpenVPN widget from all dashboards until patches are applied
Enforce firewall rules that limit web UI access to a dedicated management VLAN or VPN
Require multi-factor authentication for all web UI accounts to raise the bar for authenticated exploitation
Apply strict Content Security Policy and browser isolation for administrator workstations to reduce chained XSS risk

bash

# Configuration example: restrict web UI to a management network
# Replace 10.10.0.0/24 with your management subnet
# Applied via System > Advanced > Admin Access or equivalent firewall rule
set webConfigurator listen_address 10.10.0.1
set firewall rule allow proto tcp from 10.10.0.0/24 to 10.10.0.1 port 443
set firewall rule block proto tcp from any to 10.10.0.1 port 443