Lucene search

K
cve[email protected]CVE-2018-4021
HistoryDec 03, 2018 - 10:29 p.m.

CVE-2018-4021

2018-12-0322:29:00
CWE-78
web.nvd.nist.gov
26
cve-2018-4021
netgate pfsense
command injection
authentication bypass
security vulnerability

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.193 Low

EPSS

Percentile

96.3%

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the powerd_battery_mode POST parameter.

Affected configurations

Vulners
NVD
Node
netgatepfsenseRangeNetgate pfSense CE 2.4.4-RELEASE
VendorProductVersionCPE
netgatepfsense*cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Netgate pfSense",
    "vendor": "Netgate",
    "versions": [
      {
        "status": "affected",
        "version": "Netgate pfSense CE 2.4.4-RELEASE"
      }
    ]
  }
]

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.193 Low

EPSS

Percentile

96.3%