resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FreeBSD | FreeBSD | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 09 Mar 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
cvssV3_1
|
Mon, 09 Mar 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed. | |
| Title | Remote code execution via ND6 Router Advertisements | |
| Weaknesses | CWE-20 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: freebsd
Published:
Updated: 2026-03-09T13:59:06.534Z
Reserved: 2025-12-12T05:27:31.543Z
Link: CVE-2025-14558
Vulnrichment
Updated: 2026-03-09T13:57:59.820Z
NVD
Status : Awaiting Analysis
Published: 2026-03-09T12:16:11.140
Modified: 2026-03-09T14:16:05.083
Link: CVE-2025-14558
Redhat
No data.
OpenCVE Enrichment
No data.