{"uuid": "b05b40c0-5265-4349-8c26-ee5a5cc424c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14558", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/misc/rtsold_dnssl_cmdinject.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Lukas Johannes M\\u00f6ller\", \"Kevin Day\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability (CVE-2025-14558)\\n          in FreeBSD's rtsol(8) and rtsold(8) programs. These programs do not\\n          validate the domain search list options provided in IPv6 Router\\n          Advertisement messages; the option body is passed to resolvconf(8)\\n          unmodified. resolvconf(8) is a shell script which does not validate\\n          its input. A lack of quoting means that shell commands passed as input\\n          to resolvconf(8) may be executed, enabling command injection via $()\\n          substitution in the DNSSL domain name fields.\\n\\n          This exploit requires Layer 2 adjacency to the target (same network\\n          segment) and root privileges to send raw packets. Router advertisement\\n          messages are not routable and should be dropped by routers, so the\\n          attack does not cross network boundaries.\", \"disclosure_date\": \"2025-12-16\", \"fullname\": \"exploit/freebsd/misc/rtsold_dnssl_cmdinject\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"FreeBSD rtsold/rtsol DNSSL Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/freebsd/misc/rtsold_dnssl_cmdinject.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"freebsd/misc/rtsold_dnssl_cmdinject\", \"references\": [\"CVE-2025-14558\", \"EDB-52463\", \"URL-https://security.FreeBSD.org/advisories/FreeBSD-SA-25:12.rtsold.asc\", \"URL-https://github.com/JohannesLks/CVE-2025-14558\"], \"rport\": null, \"session_types\": false, \"targets\": [\"FreeBSD (all versions before 13.5-RELEASE-p8 / 14.3-RELEASE-p7 / 15.0-RELEASE-p1)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:19.017225Z"}