CVE-2018-16055 An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to

What is CVE-2018-16055?

CVE-2018-16055 is a high-severity vulnerability in n/a, published on 26 Sep 2018.

Official description

An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root user when submitting a request to relinquish a DHCP lease for an interface which is configured to obtain its address via DHCP.

Weakness: CWE-78

Which versions are affected by CVE-2018-16055?

It affects 1 product.

Products include Netgate Pfsense.

How do I fix CVE-2018-16055?

No fix has been published for CVE-2018-16055 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-16055 being exploited?

There is no known exploitation of CVE-2018-16055 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-16915 Path traversal in n/a Critical 9.8
• CVE-2020-21487 Cross-site scripting in n/a Critical 9.6
• CVE-2024-46538 Cross-site scripting in n/a Critical 9.3
• CVE-2023-48123 Command injection in n/a High 8.8
• CVE-2023-42326 Command injection in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qg28-hqjm-95pc.