CVE-2019-16701

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
netgatepfsense
2.3.4 ≤
𝑥
< 2.4.4
netgatepfsense
2.4.4
netgatepfsense
2.4.4:p1
netgatepfsense
2.4.4:p2
netgatepfsense
2.4.4:p3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html
https://github.com/pfsense/pfsense/commits/master
https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more
http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html
https://github.com/pfsense/pfsense/commits/master
https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more