CVE-2010-20059

N/A

Description

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.

CVE Details

CVSS v3.1 ScoreN/A

Published8/20/2025

Last Modified8/22/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-78

References

https://github.com/freenas(disclosure@vulncheck.com)

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/freenas_exec_raw.rb(disclosure@vulncheck.com)

https://sourceforge.net/projects/freenas/(disclosure@vulncheck.com)

https://web.archive.org/web/20101218143110/http://sourceforge.net/projects/freenas/files//stable/0.7.2/NOTES%200.7.2.5543.txt/view(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/16313(disclosure@vulncheck.com)

https://www.tenable.com/plugins/nnm/5714(disclosure@vulncheck.com)

https://www.truenas.com/freenas/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/freenas-arbitrary-command-execution(disclosure@vulncheck.com)

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/freenas_exec_raw.rb(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.exploit-db.com/exploits/16313(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.