CVE-2018-16055

An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root user when submitting a request to relinquish a DHCP lease for an interface which is configured to obtain its address via DHCP.

• CWE-78

• https://doddsecurity.com/190/command-injection-on-pfsense-firewalls/Third Party Advisory
• https://www.pfsense.org/security/advisories/pfSense-SA-18_08.webgui.ascMitigation, Vendor Advisory
• https://doddsecurity.com/190/command-injection-on-pfsense-firewalls/Third Party Advisory
• https://www.pfsense.org/security/advisories/pfSense-SA-18_08.webgui.ascMitigation, Vendor Advisory

Published

Sep 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16047Adobe Acrobat and Reader versions 2019.008.20081 and earlier…
• CVE-2018-16048An issue was discovered in GitLab Community and Enterprise E…
• CVE-2018-16049An issue was discovered in GitLab Community and Enterprise E…
• CVE-2018-1605IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 …5.4
• CVE-2018-16050An issue was discovered in GitLab Community and Enterprise E…
• CVE-2018-16051An issue was discovered in GitLab Community and Enterprise E…
• CVE-2018-16056In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.…
• CVE-2018-16057In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.…7.5
• CVE-2018-16058In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.…
• CVE-2018-16059Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allo…
• CVE-2018-1606IBM Jazz based applications (IBM Rational Collaborative Life…4.3
• CVE-2018-16060Mitsubishi Electric Europe B.V. SmartRTU devices allow remot…7.5