CVE-2018-4020 is a high-severity command injection vulnerability affecting Netgate pfSense CE 2.4.4-RELEASE. An authenticated attacker can exploit a flaw in the processing of the powerd_ac_mode POST parameter to execute arbitrary commands on the system. This vulnerability has a CVSS score of 7.2, indicating high impact on confidentiality, integrity, and availability, and a high EPSS score suggests a significant likelihood of exploitation. While no public exploit code or active exploitation has been observed, its high FAUCET Risk Score and the requirement for authenticated access highlight the potential for a targeted attack.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.4.4CPE matchmatch criteria | cpe:2.3:a:netgate:pfsense:2.4.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.