High severity8.8OSV Advisory· Published Jan 22, 2018· Updated Jun 17, 2026

CVE-2016-10709

Description

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pfsense/PfsenseOSV3 versions
RELENG_2_2_0, RELENG_2_2_1, RELENG_2_2_2, …+ 2 more
- (no CPE)range: RELENG_2_2_0, RELENG_2_2_1, RELENG_2_2_2, …
- cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*range: <=2.2.6
- (no CPE)range: <2.3

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/39709/nvdExploitThird Party AdvisoryVDB Entry
www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_execnvdExploitThird Party Advisory
www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdfnvdExploitThird Party Advisory
www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.ascnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.027
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000