{"id":"CVE-2023-27253","aliases":["EUVD-2023-31031","GHSA-mh3m-qv7g-hjvv"],"status":"published","title":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0...","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.89505,"percentile":0.99789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-91"],"published":"2023-03-17T00:00:00Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"exploitdb","id":"EDB-51608","title":"pfSense v2.7.0 - OS Command Injection","type":"webapps","platform":"php","date":"2023-07-20","url":"https://www.exploit-db.com/exploits/51608"},{"source":"metasploit","id":"exploit/unix/http/pfsense_config_data_exec","title":"pfSense Restore RRD Data Command Injection","type":"exploit","platform":"Unix","date":"2023-03-18","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_config_data_exec"}],"products":[{"vendor":"netgate","product":"pfsense"}],"references":[{"url":"https://redmine.pfsense.org/issues/13935","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","web"]},{"url":"https://github.com/pfsense/pfsense/commit/ca80d18493f8f91b21933ebd6b714215ae1e5e94","tags":["x_transferred","Patch","fix"]},{"url":"http://packetstormsecurity.com/files/173487/pfSense-Restore-RRD-Data-Command-Injection.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27253","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mh3m-qv7g-hjvv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27253.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-27253","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","status":"published","published":"2023-03-17T00:00:00Z","modified":"2025-02-26T14:58:43.6Z","updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-31031","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","status":"published","published":"2023-03-17T00:00:00Z","modified":"2025-02-26T14:58:43Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:23.257772Z"}],"ghsa":[{"id":"GHSA-mh3m-qv7g-hjvv","title":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0...","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","status":"published","published":"2023-03-18T00:30:53Z","modified":"2023-07-14T00:30:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:54:42.596364Z"}],"nvd":[{"id":"CVE-2023-27253","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","status":"published","published":"2023-03-17T22:15:11.227Z","modified":"2026-06-17T05:44:39.813Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"CVE-2023-27253","description":"A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.","status":"published","published":"2023-03-17T00:00:00Z","modified":"2026-10-28T02:30:30.925369114Z","updated_at":"2026-11-02T15:44:31.135751Z"}]}}