Security Advisory
CVE-2019-16667
8.8
HIGH
Vulnerability Description
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
Published Date
September 26, 2019
Official Source
NIST NVD Advisory