LiveActive security incident?Get immediate response
CVE Record

CVE-2018-4020: An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes...

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_ac_mode` POST parameter parameter.

HighCVSS 7.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-4020 lets an authenticated administrator-level attacker execute operating system commands through the pfSense CE web administration interface. The issue is serious because successful exploitation can compromise confidentiality, integrity, and availability of the firewall. The source bundle only identifies Netgate pfSense CE 2.4.4-RELEASE as affected.

Executive priority

Treat this as a high-priority firewall platform issue if any affected version remains in use. The business concern is not broad unauthenticated scanning; it is the consequence of a stolen or misused admin session leading to command execution on a network control point.

Technical view

The vulnerability is command injection in Netgate pfSense CE 2.4.4-RELEASE when processing a specific authenticated POST request to the admin web interface. The vulnerable input is identified as the powerd_ac_mode POST parameter. CVSS 3.0 is 7.2 with network access, low complexity, high privileges, no user interaction, and high CIA impact.

Likely exposure

Exposure is most likely on pfSense CE 2.4.4-RELEASE systems where the administration web interface is reachable by administrators or compromised admin accounts. Internet-exposed admin interfaces increase business risk, but the cited source requires authenticated POST access, not unauthenticated remote access.

Exploitation context

The provided data does not show CISA KEV listing or active exploitation. The vulnerability is still high impact because an authenticated attacker can execute arbitrary system commands on a firewall, potentially affecting traffic control, monitoring, and network availability.

Researcher notes

Evidence supports command injection through an authenticated admin POST parameter in pfSense CE 2.4.4-RELEASE. The source bundle does not provide a fixed version, patch details, exploit availability, CWE mapping, or indicators of compromise, so validation should stay version-, access-, and log-focused.

Mitigation direction

  • Identify and prioritize pfSense CE 2.4.4-RELEASE systems.
  • Check Netgate guidance for the vendor-supported fixed release or mitigation.
  • Restrict admin web interface access to trusted management networks only.
  • Review and reduce administrator accounts with web interface access.
  • Enforce strong authentication and monitor administrator login activity.

Validation and detection

  • Confirm the exact pfSense CE version on each firewall.
  • Verify the admin web interface is not broadly reachable.
  • Review administrative access logs for unexpected sessions or changes.
  • Check configuration history for unauthorized power-management changes.
  • Confirm remediation against Netgate release notes or advisory guidance.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-4020 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.2 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.2CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

7.2High
CVSS 3.0 vector shape for CVE-2018-4020Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NetgateNetgate pfSenseNetgate pfSense CE 2.4.4-RELEASEListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.