Exploitation Summary
EIP tracks 4 public exploits for CVE-2025-14558.
PoCs published by Lukas Johannes Möller, JohannesLks, rockmelodies, including Metasploit module exploits/freebsd/misc/rtsold_dnssl_cmdinject.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in FreeBSD's rtsold via maliciously crafted DNSSL options in IPv6 Router Advertisement packets. The payload is encoded to bypass shell metacharacter validation and achieve remote code execution through resolvconf's unquoted variable expansion.
Description
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
Exploits (4)
This exploit leverages a command injection vulnerability in FreeBSD's rtsold via maliciously crafted DNSSL options in IPv6 Router Advertisement packets. The payload is encoded to bypass shell metacharacter validation and achieve remote code execution through resolvconf's unquoted variable expansion.
This is a functional exploit for CVE-2025-14558, targeting a command injection vulnerability in FreeBSD's rtsold via maliciously crafted DNSSL options in IPv6 Router Advertisements. The PoC uses Scapy to send packets with embedded shell metacharacters, achieving remote code execution on vulnerable systems.
This is a functional proof-of-concept exploit for CVE-2025-14558, demonstrating remote command injection via crafted IPv6 Router Advertisement packets targeting FreeBSD's rtsold service. It uses Scapy to send malicious DNSSL options that trigger command execution as root.
This Metasploit module exploits CVE-2025-14558, a command injection vulnerability in FreeBSD's rtsol(8) and rtsold(8) via malformed DNSSL options in IPv6 Router Advertisement packets. The exploit sends crafted packets to trigger command execution via shell substitution in resolvconf(8).
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H