CVE-2023-29974
CVE-2023-29974 is a critical-severity vulnerability in Pfsense with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-521.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 2% (75th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-521
- Affected product: Pfsense
- Published:
- Last modified:
Description
An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
Frequently asked questions
- What is CVE-2023-29974?
- An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
- How severe is CVE-2023-29974?
- CVE-2023-29974 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2023-29974 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-29974?
- CVE-2023-29974 affects Pfsense. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-29974?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2023-29974 published?
- CVE-2023-29974 was published on 2023-11-08 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:pfsense:pfsense:2.6.0:*:*:*:community:*:*:*
More vulnerabilities in Pfsense
- CVE-2025-69691 — Critical (CVSS 9.9): Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this…
- CVE-2023-27100 — Critical (CVSS 9.8): Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software…
- CVE-2025-69690 — Critical (CVSS 9.1): Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP…
- CVE-2021-41282 — High (CVSS 8.8): diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data…
- CVE-2016-10709 — High (CVSS 8.8): pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the…
- CVE-2020-19678 — High (CVSS 7.5): Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote…
Other CWE-521 (Weak Password Requirements) vulnerabilities
- CVE-2026-25715 — Critical (CVSS 9.8): The web management interface of the device allows the administrator username and password to be set to blank values.…
- CVE-2025-53963 — Critical (CVSS 9.8): An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible…
- CVE-2025-63747 — Critical (CVSS 9.8): QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit…
- CVE-2025-12552 — Critical (CVSS 9.8): Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-11200 — Critical (CVSS 9.8): MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
- CVE-2025-12364 — Critical (CVSS 9.8): Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Browse all CWE-521 (Weak Password Requirements) vulnerabilities →