CVE-2018-4019

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_normal_mode` parameter.

• CWE-78

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0690Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0690Exploit, Third Party Advisory

Published

Dec 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-4013An exploitable code execution vulnerability exists in the HT…9.8
• CVE-2018-4014An exploitable code execution vulnerability exists in Wi-Fi …9.8
• CVE-2018-4015An exploitable vulnerability exists in the HTTP client funct…8.1
• CVE-2018-4016An exploitable code execution vulnerability exists in the UR…8.8
• CVE-2018-4017An exploitable vulnerability exists in the Wi-Fi Access Poin…8.8
• CVE-2018-4018An exploitable firmware update vulnerability exists in the N…9.8
• CVE-2018-4020An exploitable command injection vulnerability exists in the…7.2
• CVE-2018-4021An exploitable command injection vulnerability exists in the…7.2
• CVE-2018-4022A use-after-free vulnerability exists in the way MKVToolNix …7.8
• CVE-2018-4023An exploitable code execution vulnerability exists in the XM…9.8
• CVE-2018-4024An exploitable denial-of-service vulnerability exists in the…7.5
• CVE-2018-4025An exploitable denial-of-service vulnerability exists in the…7.5