FreeBSD's rtsold service has a vulnerability (CVE 2025 14558), allowing an attacker to execute arbitrary code on systems via malformed/illegal IPv6 Router Advertisements. This newly discovered vulnerability is considered high severity, and as such, it exists in several)(multiple) versions of FreeBSD and has great implications for systems with IPv6 Autoconfiguration enabled.
The rtsold(8) service processes the DNS Search List (DNSSL) options that arrive with IPv6 Router Advertisements, using ksh (or other shell-type programs) to interpret the options contained in these advertisements. The designated ksh utility defined as resolvconf(8) does not sanitize (or filter) these domain names, so an attacker can maliciously inject shell commands using syntax such as $() into the ksh program by sending a malformed DNSSL with the IPv6 Router Advertisement destined to the vulnerable target.
In essence, a local attacker that has Layer 2 access to the targeted system can create a Faulty DNSSL option, (which is embedded in the IPv6 Router Advertisement), that when processed by the vulnerable rtsold(8) service will run with the privileges of the root user and give them total control of that system.
To exploit this vulnerability, an attacker would require:
1. Local access to the same IPv6 network as the targeted victim (via Layer 2)
2. A targeted system that has rtsold running and has ACCEPT_RTADV set to YES
3. The use of raw packets to send continuous Router Advertisements to the targeted victim
There is no user interaction required for this exploitation and it does not require any form of authentication and should be viewed as very dangerous in a shared or untrusted network environment.
The vulnerability is found in FreeBSD versions 13.x, 14.x, and 15.x. Additionally, any FreeBSD systems that are using versions of FreeBSD that do not have security fixes applied on or before December 16, 2025, are also at risk of being compromised due to this vulnerability.
While most people consider the processing of router advertisements as being of little risk, this vulnerability demonstrates how router advertisement processing can become a vector for a network-based attack to take place. The fact that the rtsold daemon processes router advertisements with elevated privileges means that exploitation of this vulnerability may go unnoticed and provide attackers with continued access to the targeted FreeBSD system.
Furthermore, the issue of unsafe handling of shell commands by various FreeBSD utilities is an established theme across this vulnerability type and other types of vulnerabilities. Many times, even though users may have trusted procedures for configuring their systems, those trusted procedures can become an entry point into the system if input validation is ignored.
Users of FreeBSD should immediately perform the following actions to mitigate the impact of this vulnerability and keep their systems as secure as possible:
1. Install official FreeBSD security updates as soon as possible.
2. Disable the rtsold daemon from running on any FreeBSD system that does not require IPv6 autoconfiguration to be enabled.
3. Implement network-based controls to restrict IPv6 Router Advertisements.
4. Monitor for unexpected changes to DNS resolver configuration settings.
Additionally, any organization that operates or supports IPv6 networks should review the underlying trust assumptions for local network traffic and should strongly consider deploying an RA Guard or similar mechanism to mitigate the risks associated with this type of vulnerability.
Source: Exploit DB
