CVE-2018-4021
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_battery_mode` POST parameter.
- Affected products
- Pfsense Ce
- Netgate Pfsense
- = 2.4.4
- CVSS 3.1
- 7.2 HIGH
- EPSS
- 72.2% (99th percentile)
- Weakness
- CWE-78
- NVD status
- Modified
- Published
- 2018-12-03
CVE-2018-4021 at NVD
No indexed exploits for CVE-2018-4021 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2018-4021 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.