CVE-2018-4021: netgate netgate pfsense OS Command Injection

Vulnerability summary

CVE-2018-4021 is a high (CVSS 7.2) OS Command Injection vulnerability in netgate netgate pfsense. EPSS estimates a 72.21% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-12-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_battery_mode` POST parameter.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.