CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-01-22

Last modified

2024-08-06

Weaknesses

CWE-78

Affected products

• Pfsense (Pfsense)

References

• https://www.exploit-db.com/exploits/39709/
• https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc
• https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec
• https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf