CVE-2019-16701

EUVD-2019-7251 · Published Sep 25, 2019

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.

Technologies

Netgate Pfsense

Weaknesses

CWE-78

CVSS scores

v3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
v2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html
https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more
https://github.com/pfsense/pfsense/commits/master

Potentially impacted assets

See if this affects your attack surface