CVE-2014-4688

CVE-2014-4688 describes a command injection vulnerability in pfSense versions prior to 2.1.4. Authenticated attackers could execute arbitrary commands by manipulating specific input fields within diag_dns.php, diag_smart.php, or status_rrd_graph_img.php. With a CVSS score of 6.5, this vulnerability has a network attack vector, low attack complexity, and could lead to partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, an exploit for status_rrd_graph_img.php exists on ExploitDB, though there is no evidence of active exploitation or significant community discussion.