CVE-2018-4020

high · 7.2

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_ac_mode` POST parameter parameter.

7.2

CVSS

48.7%

EPSS (exploit prob.)

99th

EPSS percentile

2018-12-03

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
netgate	pfsense	2.4.4

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0690
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0690

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-4020