CVE-2010-20059: Ixsystems Freenas

Critical severity, CVSS 9.3. EPSS: 1.5% chance of exploitation in the next 30 days.

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.

Affected products

• Ixsystems Freenas: before 0.7.2 rev 5543 (fixed in 0.7.2 rev 5543)

Published 2025-08-20. Last modified 2026-06-16.