Description

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T22:16:40.020Z",
  "pubdate": "2026-08-06T22:16:40.020Z",
  "executiveSummary": "Packetfence version 13.2.0 is susceptible to an authenticated remote code execution vulnerability residing within its WebGui interface settings. This security flaw enables a remote attacker with administrative or sufficiently privileged interface access to execute arbitrary system commands on the underlying host operating system. The vulnerability poses a severe risk to organizational infrastructure, as successful exploitation bypasses standard application-layer restrictions and compromises the confidentiality, integrity, and availability of the affected server. Exploitation requires prior authentication to the administrative WebGui, indicating that an attacker must first obtain valid credentials or leverage a separate authentication bypass mechanism. Once authenticated, the attacker can interact with the vulnerable settings component to inject and trigger malicious payloads. The resultant impact includes complete system takeover, unauthorized data access, lateral movement within the network environment, and persistent backdoor installation. Organizations deploying the affected software version face a critical risk vector that necessitates immediate remediation through patching, administrative access restriction, and continuous monitoring for anomalous subprocess execution originating from the web server context.",
  "technicalDetails": "The vulnerability exists within the WebGui interface settings component of Packetfence version 13.2.0, specifically concerning how user-supplied input or configuration parameters are processed and passed to the underlying operating system. The root cause stems from insecure input validation and improper neutralization of special elements utilized in system command execution routines. When an authenticated user modifies specific WebGui interface settings, the application fails to adequately sanitize the parameters before evaluating them within a backend execution context, such as a shell invocation or system evaluation function.\nThe attack flow begins with the adversary establishing an authenticated session against the Packetfence WebGui. This requires valid credentials, which may be acquired via brute-force attacks, credential stuffing, phishing, or default credential misuse. Upon successful authentication, the attacker navigates to the targeted WebGui settings module where configuration parameters are managed. The attacker crafts a malicious input string containing operating system command injection payloads embedded within the legitimate configuration fields. Upon submitting the form, the WebGui application processes the request and improperly passes the unsanitized configuration data to the backend interpreter.\nThe vulnerable component parses the payload and executes it with the privilege level of the web application daemon or the user running the Packetfence service, often resulting in root-level or high-privilege code execution. Because the attack vector relies on authenticated remote access over the network, exposure is constrained primarily by network segmentation and the strength of the authentication mechanism, unless exposed directly to the public internet. The payload behavior allows the execution of arbitrary system binaries, scripts, or reverse shells, leading to comprehensive post-exploitation capabilities including privilege escalation, sensitive data exfiltration, modification of system configurations, and the deployment of persistent malicious agents within the network topology."
}