Jared Stephens

**Name of the Vulnerable Software and Affected Versions** pfSense versions prior to 2.3 **Description** The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by including a '|' character in the `graph` parameter of the status rrd graph img.php file, which is related to rrd graph img.php. **Recommendations** For versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the status rrd graph img.php file to minimize the risk of exploitation. Avoid using the '|' character in the `graph` parameter until the issue is resolved.