Read the docs
TI-2018-02989 Aliases CVE-2018-4021GHSA-72vm-95rx-hpr3

OS command injection in Netgate pfSense

Priority HIGH 69CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_battery_mode` POST parameter.

Why it matters now

EPSS 0.70313 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetgateNetgate pfSenseNetgate pfSense CE 2.4.4-RELEASE—No fix listedCNA
  • Netgate pfSense VendorNetgate Affected Netgate pfSense CE 2.4.4-RELEASE Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netgate:pfsense:2.4.4:*:*:*:*:*:*:*2.4.4VulnerableNetgate
  • cpe:2.3:a:netgate:pfsense:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Netgate

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-4021
  2. 2026-10-03 Alias added: GHSA-72vm-95rx-hpr3

References

Exploit 1

  • TI-2023-12003 A command injection vulnerability in the function restore_rrddata() of Netgate pfSense… CVSS 3.1HIGH 8.8
  • TI-2024-31010 A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute… CVSS 3.1CRITICAL 9.3
  • TI-2023-26046 An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a… CVSS 3.1HIGH 8.8
  • TI-2023-22567 An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code… CVSS 3.1HIGH 8.8
  • TI-2019-12464 diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer… CVSS 3.1HIGH 8.8
  • TI-2015-02028 Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php… CVSS 2.0MEDIUM 6.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences