CVE-2016-10709: pfsense OS Command Injection
Vulnerability summary
CVE-2016-10709 is a high (CVSS 9.0) OS Command Injection vulnerability in pfsense. EPSS estimates a 33.71% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 22-01-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
33.71%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 33.71% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundpfSense Community Edition 2.2.6 - Multiple Vulnerabilities
Maturity: poc
Exploit Reference (rapid7.com)
Maturity: unknown
Exploit Reference (security-assessment.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Pfsense1 product
- pfsense≤ 2.2.6
1 vendor · 1 product
References
4 links- www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_execX Refsource MISCExploitThird Party Advisory
- www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdfX Refsource MISCExploitThird Party Advisory