Cross-Site Request Forgery Vulnerability in pfSense by Netgate
CVE-2019-16667

8.8HIGH

Key Information:

Vendor

Netgate

Status
Pfsense
Vendor
CVE Published:
26 September 2019

What is CVE-2019-16667?

A Cross-Site Request Forgery vulnerability exists in diag_command.php within pfSense 2.4.4-p3, allowing an attacker to execute OS commands by exploiting the txtCommand or txtRecallBuffer fields. The issue arises when a CSRF token is absent, leading to a 'CSRF token expired' error generated by csrf_callback(). This vulnerability may compromise the security of the pfSense firewall, making it crucial for users to apply necessary safeguards.

References

https://pastebin.com/TEJdu9LN
x_refsource_MISC
http://packetstormsecurity.com/files/158614/pfSense-2.4.4...
x_refsource_MISC

EPSS Score

49% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.