CVE-2025-14558

highpriority · track · 12EPSS 0.065 · 94 %ileexploit · weaponizedDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · weaponized

Likely / severe?

6.52% (94th) EPSS

CVSS 8.8 · high

Is it mine?

15 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.2 · impact 5.9

v3.17highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Fsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-78US

exploits (4)

Public proof-of-concept and weaponised exploit code.

exploit/freebsd/misc/rtsold_dnssl_cmdinjectFreeBSD rtsold/rtsol DNSSL Command Injectionweaponized · metasploit
EDB-52463FreeBSD rtsold 15.x - Remote Code Execution via DNSSLPoC · exploit_db
JohannesLks/CVE-2025-14558FreeBSD rtsold DNSSL Command Injection (RCE)PoC · poc_in_github
rockmelodies/Blackash-CVE-2025-14558CVE-2025-14558PoC · poc_in_github

affected products (15)

Products and version ranges known to be affected.

FreeBSD Project FreeBSD OS <13.5_8all versionscert_bundDE
FreeBSD Project FreeBSD OS <14.3_7all versionscert_bundDE
FreeBSD Project FreeBSD OS <15.0_1all versionscert_bundDE
FreeBSD Project FreeBSD OS< 13.5_8cert_bundDE
FreeBSD Project FreeBSD OS< 14.3_7cert_bundDE
FreeBSD Project FreeBSD OS< 15.0_1cert_bundDE
FreeBSD FreeBSD13.5-RELEASE → p8enisa_euvdEU
FreeBSD FreeBSD14.3-RELEASE → p7enisa_euvdEU
FreeBSD FreeBSD15.0-RELEASE → p1enisa_euvdEU
FreeBSD Project FreeBSD≤ 15.0-RELEASE-p1fstec_bduRU
FreeBSD Project FreeBSD≤ 14.3-RELEASE-p7fstec_bduRU
FreeBSD Project FreeBSD≤ 13.5-RELEASE-p8fstec_bduRU
freebsd freebsd= 13.5nvdUScpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
freebsd freebsd= 14.3nvdUScpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
freebsd freebsd= 15.0nvdUScpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2874FreeBSD Project FreeBSD OS: Mehrere SchwachstellenDeutsch2025-12-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand zu verursachen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2026-03-09modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan