UpHeron
All vulnerabilities

Servers and applications

CVE-2018-16055

An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root…

Severity
High 8.8
Published
26 Sept 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.4.4
Exploit chance
11% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
pfSenseServers and applications · cpe:a:netgate:pfsense
  • Every version before 2.4.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-16055
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-16055