CVE-2019-12949

MEDIUM

pfSense 2.4.4-p2 and 2.4.4-p3 - Authenticated Remote Code Execution via XSS in diag_command.php and rrd_fetch_json.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-12949. PoCs published by tarantula-team.

AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2019-12949, demonstrating an XSS vulnerability in pfSense 2.4.4-p2 and 2.4.4-p3 that can be chained to achieve remote code execution (RCE) via CSRF and file upload. The PoC includes detailed steps and code snippets for exploiting the vulnerability.

Description

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.

Exploits (1)

nomisec WORKING POC 26 stars
by tarantula-team · poc
https://github.com/tarantula-team/CVE-2019-12949

This repository provides a functional proof-of-concept for CVE-2019-12949, demonstrating an XSS vulnerability in pfSense 2.4.4-p2 and 2.4.4-p3 that can be chained to achieve remote code execution (RCE) via CSRF and file upload. The PoC includes detailed steps and code snippets for exploiting the vulnerability.

Classification
Working Poc 95%
Attack Type
Xss, Rce
Complexity
Moderate
Reliability
Reliable
Target: pfSense 2.4.4-p2, 2.4.4-p3
Auth required
Prerequisites: Authenticated administrator session on pfSense · Victim interaction (clicking a malicious link)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/tarantula-team/CVE-2019-12949

Scores

CVSS v3 6.1
EPSS 0.0303
EPSS Percentile 85.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
netgate/pfsense 2.4.4 p2 (2 CPE variants)
Published Jun 25, 2019
Tracked Since Feb 18, 2026