CVE-2019-16667: pfSense diag_command.php CSRF enables OS command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS plus public exploit references make this a serious risk for exposed pfSense management interfaces, though it requires an authenticated admin and user interaction.

What it is

diag_command.php in pfSense 2.4.4-p3 is vulnerable to cross-site request forgery through the txtCommand or txtRecallBuffer fields, allowing an attacker to make a logged-in administrator execute arbitrary OS commands. The flaw stems from csrf_callback() returning a "CSRF token expired" error with a Try Again button when the token is missing, which weakens the CSRF protection. It matters because a firewall/edge device command execution can lead to full compromise of the appliance.

Impact

An attacker who lures an authenticated pfSense administrator into a crafted request can execute arbitrary OS commands on the firewall with the admin's privileges, potentially leading to full device compromise and network-level impact.

Attack surface

The flaw is reachable over the network via a crafted web request to diag_command.php; it requires the victim to be authenticated to pfSense and to be induced into triggering the request (user interaction), as reflected by the CVSS vector AV:N/PR:N/UI:R.

Exploitation

CVE-2019-16667 is not listed in CISA KEV, but EPSS is high (0.54541, ~99th percentile) and public references include an Exploit-tagged third-party advisory, indicating exploit code or proof-of-concept is publicly available.

What to do

• Upgrade pfSense to a version later than 2.4.4-p3 that fixes the CSRF handling in diag_command.php.
• Restrict administrative webGUI access to trusted management networks and avoid exposing it to the internet.
• Require administrators to log out of pfSense before browsing untrusted sites and use a separate browser profile for appliance management.
• Apply CSRF protections at the reverse proxy or WAF layer for the pfSense management interface where feasible.

Detection

• Monitor web server or firewall logs for POST requests to diag_command.php with txtCommand or txtRecallBuffer parameters from unexpected sources.
• Alert on pfSense admin sessions that generate command-execution activity shortly after a cross-site request pattern.
• Review authentication and audit logs for anomalous admin actions or unexpected command execution on the appliance.
• Hunt for known exploit payload strings or referer patterns associated with the public PoC against diag_command.php.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.