CVE-2016-10709: pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter…

PriorityP271high8.8CVSS 3.0

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

34.25%

98.2th percentile

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
pfsense	pfsense	<= 2.2.6	—

Detection & IOCsextracted from sources · hover to see the quote

path/status_rrd_graph_img.php↗

path/_rrd_graph_img.php↗

command|↗

→Monitor HTTP GET requests to /_rrd_graph_img.php or /status_rrd_graph_img.php for the presence of a pipe character ('|') in the 'graph' parameter, which is the injection point for OS command execution. ↗
→Alert on authenticated POST/GET requests to /system_groupmanager.php on pfSense <= 2.3.1_1 that contain shell metacharacters, as this endpoint is also exploitable for RCE. ↗
→Commands injected via this vulnerability execute as root; look for unexpected child processes spawned from the pfSense web server process (e.g., php/lighttpd) on BSD-based systems. ↗

·Exploitation requires prior authentication; unauthenticated attackers cannot directly trigger this vulnerability. Detection should focus on authenticated sessions abusing these endpoints. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.