{"id":"CVE-2016-10709","aliases":["EUVD-2016-1708","GHSA-wcgm-j5v9-x43g"],"status":"published","title":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|'...","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.33708,"percentile":0.98395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2018-01-22T04:00:00Z","modified":"2026-10-24T10:31:01Z","exploits":[{"source":"metasploit","id":"exploit/unix/http/pfsense_graph_injection_exec","title":"pfSense authenticated graph status RCE","type":"exploit","platform":"PHP","date":"2016-04-18","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec"},{"source":"metasploit","id":"exploit/unix/http/pfsense_group_member_exec","title":"pfSense authenticated group member RCE","type":"exploit","platform":"Unix","date":"2017-11-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_group_member_exec"},{"source":"pocgithub","id":"wetw0rk/Exploit-Development","title":"wetw0rk/Exploit-Development","date":"2017-04-26","url":"https://github.com/wetw0rk/Exploit-Development"}],"products":[{"vendor":"pfsense","product":"pfsense"}],"references":[{"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.exploit-db.com/exploits/39709/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10709"},{"url":"https://github.com/advisories/GHSA-wcgm-j5v9-x43g"}],"sources":{"cve":[{"id":"CVE-2016-10709","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","status":"published","published":"2018-01-22T04:00:00Z","modified":"2024-08-06T03:30:20.167Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1708","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","status":"published","published":"2018-01-22T04:00:00Z","modified":"2024-08-06T03:30:20Z","updated_at":"2026-11-03T02:22:23.66215Z"}],"ghsa":[{"id":"GHSA-wcgm-j5v9-x43g","title":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|'...","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","status":"published","published":"2022-05-14T03:45:23Z","modified":"2023-02-03T05:00:31Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:52:48.49301Z"}],"nvd":[{"id":"CVE-2016-10709","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","status":"published","published":"2018-01-22T04:29:00.203Z","modified":"2026-06-17T00:40:12.477Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"CVE-2016-10709","description":"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.","status":"published","published":"2018-01-22T04:29:00.203Z","modified":"2026-10-24T10:31:01.610903094Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"}]}}