Command Injection Vulnerability in Netgate pfSense CE Administration Interface
CVE-2018-4021

7.2HIGH

Key Information:

Vendor

Netgate

Status
Netgate Pfsense
Vendor
CVE Published:
3 December 2018

What is CVE-2018-4021?

A command injection vulnerability is present in the Netgate pfSense CE 2.4.4-RELEASE product, where specially crafted POST requests can be sent to the administration web interface. This allows an authenticated attacker to manipulate the powerd_battery_mode parameter, enabling them to execute arbitrary commands on the underlying system. This vulnerability underscores the necessity for secure coding standards and the importance of validation for input parameters in web applications.

Affected Version(s)

Netgate pfSense Netgate pfSense CE 2.4.4-RELEASE

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

EPSS Score

86% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.