medium6.5Public exploit code
CVE-2014-4688
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection2018-01-15 · webapps · php
Impact
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netgate | Pfsense | through 2.1.3 |