Command Injection Vulnerability in Netgate pfSense CE by Netgate
CVE-2018-4020

7.2HIGH

Key Information:

Vendor

Netgate

Status
Netgate Pfsense
Vendor
CVE Published:
3 December 2018

What is CVE-2018-4020?

A command injection vulnerability exists in Netgate pfSense CE 2.4.4-RELEASE due to improper processing of parameters in specific POST requests. This flaw allows an authenticated attacker to execute arbitrary commands on the system by manipulating the powerd_ac_mode POST parameter while sending valid requests to the administration web interface. The implications of this vulnerability can lead to unauthorized access and control of the affected system, highlighting the importance of securing administration interfaces.

Affected Version(s)

Netgate pfSense Netgate pfSense CE 2.4.4-RELEASE

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

EPSS Score

85% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.