CVE-2010-20059
BaseFortify
Publication date: 2025-08-20
Last updated on: 2025-08-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freenas | freenas | 0.7.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in FreeNAS 0.7.2 prior to revision 5543 is an unauthenticated command-execution backdoor in its web interface. Specifically, the exec_raw.php script accepts a cmd parameter that is passed directly to the underlying shell without any sanitation, allowing attackers to execute arbitrary commands remotely without authentication.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary commands on the affected system remotely without any authentication. This can lead to full system compromise, unauthorized access to data, disruption of services, and potentially further attacks within the network.