CVE-2018-4019

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...

Vulnerability Spotlight: Netgate pfSense system_advanced_misc.php powerd_normal_mode Command Injection Vulnerability

Brandon Stultz of Cisco Talos discovered these vulnerabilities. Executive summary Today, Cisco Talos is disclosing a command injection vulnerability in Netgate pfSense systemadvancedmisc.php powerdnormalmode. pfSense is a free and open source firewall and router that also features unified threat...

CVE-2018-4019: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated...