pfSense Cross-Site Request Forgery Vulnerability (CNVD-2019-43356)

pfsense is an open source routing and firewall software , based on freebsd system customization and development . pfSense 2.4.4-p3 in diagcommand.php cross-site request forgery vulnerability. An attacker can exploit this vulnerability to execute OS commands via the txtCommand or txtRecallBuffer...

CVE-2019-16667: Cross-Site Request Forgery (CSRF)

diagcommand.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrfcallback produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing...