Vulnerability CVE-2019-16701
Published: 2019-09-25

Description:
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.

See advisories in our WLB2 database:
Topic
Author
Date
High
pfSense 2.3.4 / 2.4.4-p3 Remote Code Injection
Nassim Asrir
25.09.2019

Type:

CWE-78

 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Netgate -> Pfsense 

 References:
http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html
https://github.com/pfsense/pfsense/commits/master
https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more
Copyright 2024, cxsecurity.com

 

Back to Top