CVE-2019-16667: Netgate Pfsense

High severity, CVSS 8.8. EPSS: 54.5% chance of exploitation in the next 30 days.

diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.

Affected products

• Netgate Pfsense: version 2.4.4 only

Published 2019-09-26. Last modified 2026-06-17.