CVE-2016-10709: Pfsense

High severity, CVSS 8.8. EPSS: 33.7% chance of exploitation in the next 30 days.

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

Affected products

• Pfsense Pfsense: up to and including 2.2.6

Published 2018-01-22. Last modified 2026-06-17.