CVE-2018-4021

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4021

The CVE-2018-4021 entry concerns Netgate pfSense CE 2.4.4-RELEASE and describes a command injection vulnerability in the POST parameter powerd_battery_mode (and relatedly in powerd_normal_mode and powerd_ac_mode per TALOS). An attacker who can send authenticated POST requests to the pfSense web G...

CVE-2018-4019

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4021

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

CVE-2018-4019

Netgate pfSense CE 2.4.4-RELEASE is affected by three remote command-injection vulnerabilities in the POST handling of system_advanced_misc.php (powerd_normal_mode, powerd_ac_mode, powerd_battery_mode). An attacker must authenticate to the pfSense web admin interface to exploit these via crafted ...

CVE-2018-4020

PfSense CE 2.4.4-RELEASE is affected by three command-injection vulnerabilities in POST handlers of system_advanced_misc.php, via powerd_normal_mode, powerd_ac_mode, and powerd_battery_mode parameters. The root cause is improper sanitization of these POST values, allowing an authenticated attacke...

Vulnerability Spotlight: Netgate pfSense system_advanced_misc.php powerd_normal_mode Command Injection Vulnerability

Brandon Stultz of Cisco Talos discovered these vulnerabilities. Executive summary Today, Cisco Talos is disclosing a command injection vulnerability in Netgate pfSense systemadvancedmisc.php powerdnormalmode. pfSense is a free and open source firewall and router that also features unified threat...

Netgate pfSense system_advanced_misc.php multiple remote command injection vulnerabilities

Summary Three exploitable command injection vulnerabilities exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send...

Electric Sheep Fencing pfsense command injection vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A command injection vulnerability exists in the statusinterfaces.php file in Electric Sheep Fencing pfSense versions prior to 2.4.4, which can be exploited by an attack...

CVE-2018-16055

An authenticated command injection vulnerability exists in statusinterfaces.php via dhcprelinquishlease in pfSense before 2.4.4 due to its passing user input from the $POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGU...

CVE-2018-16055

An authenticated command injection vulnerability exists in statusinterfaces.php via dhcprelinquishlease in pfSense before 2.4.4 due to its passing user input from the $POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGU...

Command injection

An authenticated command injection vulnerability exists in statusinterfaces.php via dhcprelinquishlease in pfSense before 2.4.4 due to its passing user input from the $POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGU...

CVE-2018-16055

pfSense before 2.4.4 is affected by an authenticated command injection in status_interfaces.php (dhcp_relinquish_lease()). User input from POST parameters ifdescr and ipv is passed to a shell without escaping, allowing an authenticated WebGUI user with privileges on the page to execute commands a...

CVE-2018-16055

An authenticated command injection vulnerability exists in statusinterfaces.php via dhcprelinquishlease in pfSense before 2.4.4 due to its passing user input from the $POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGU...

CVE-2017-1000479

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pfsenseclickjacking.rb 2026-09-08 06:50:36+00:00| seen|...

pfSense Post-Auth Command Execution Vulnerability

pfSense is a free and open source firewall and router software under FreeBSD. A command execution vulnerability exists in pfSense Post-Auth. An attacker can exploit this vulnerability to gain privileges to execute commands in the root user's environment...

pfSense < 2.3.5 Multiple Vulnerabilities (KRACK)

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109037; scriptversion"1.13";...

pfSense < 2.4.3 Multiple Vulnerabilities (SA-18_01 / SA-18_02 / SA-18_03) (Meltdown) (Spectre)

According to its self-reported version number, the remote pfSense install is a version prior to 2.4.3 It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid109038;...

pfSense End of Life (EOL) Detection

The pfSense version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

pfSense < 2.1.5 Multiple Vulnerabilities ( SA-14_14 )

According to its self-reported version number, the remote pfSense install is a version prior to 2.1.5 It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108516; scriptversion"1.4";...