FreeBSD rtsold 15.x · Remote Code Execution via DNSSL
Source Exploit-DB RSS Feed
Rated by Threat Radar
Data as of 19 Jan 2026, 19:42 UTC
What to do
AI-suggested
Since no official patches are currently available, organizations should immediately implement network-level mitigations such as filtering or blocking unsolicited IPv6 router solicitation packets from untrusted sources. Disable or restrict the use of rtsold where feasible, especially on systems exposed to untrusted networks. Employ network segmentation to limit exposure of vulnerable FreeBSD hosts. Monitor network traffic for suspicious DNSSL option packets and anomalous rtsold activity. Consider deploying intrusion detection/prevention systems with custom signatures targeting this exploit. Maintain up-to-date backups and prepare incident response plans for potential exploitation. Stay alert for official patches or advisories from FreeBSD and apply them promptly once released. Engage with FreeBSD community channels for updates and mitigation guidance.
Description
FreeBSD rtsold 15.x - Remote Code Execution via DNSSL
Indicators of compromise
Exploit source code
# Exploit Title: FreeBSD rtsold 15.x - Remote Code Execution via DNSSL
# Date: 2025-12-16
# Exploit Author: Lukas Johannes Möller
# Vendor Homepage: https://www.freebsd.org/
# Version: FreeBSD 13.x, 14.x, 15.x (before 2025-12-16 patches)
# Tested on: FreeBSD 14.1-RELEASE
# CVE: CVE-2025-14558
#
# Description:
# rtsold(8) processes IPv6 Router Advertisement DNSSL options without
# validating domain names for shell metacharacters. The decoded domains
# are passed to resolvconf(8), a shell sc…