CVE-2018-4019: Netgate pfSense CE command injection in powerd_normal_mode parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityAuthenticated remote command execution on a perimeter firewall with a high EPSS score and public exploit detail, though exploitation requires valid admin credentials and no KEV listing exists.

What it is

Netgate pfSense CE 2.4.4-RELEASE fails to sanitize the powerd_normal_mode parameter of a specific POST request, allowing OS command injection. An attacker who can send authenticated POST requests to the administration web interface can execute arbitrary commands on the firewall. This matters because pfSense is a perimeter device, so command execution there can expose or disrupt the whole protected network.

Impact

An attacker gains arbitrary command execution on the pfSense system with the privileges of the web interface process, enabling full compromise of the firewall host and anything it protects.

Attack surface

Reached over the network through the administration web interface via a crafted POST request; the CVSS vector (AV:N/PR:H/UI:N) indicates valid administrative authentication is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is high (0.48721, 98.8th percentile), and the only references are Talos advisory entries tagged Exploit, indicating public exploit detail exists but no confirmed in-the-wild activity is recorded here.

What to do

• Upgrade pfSense CE past 2.4.4-RELEASE to a release that fixes the powerd_normal_mode command injection.
• Restrict administrative web interface access to trusted management networks and never expose it to the internet.
• Enforce strong unique admin credentials and multi-factor authentication where supported to limit abuse of authenticated POST access.
• Audit and remove unnecessary admin accounts, and monitor for unexpected changes to powerd or system configuration.
• Where feasible, apply network segmentation so a compromised firewall host cannot freely reach internal segments.

Detection

• Review web server and system logs for POST requests to the administration interface containing powerd_normal_mode with shell metacharacters.
• Alert on unexpected child processes or shell invocations spawned by the pfSense web interface process.
• Monitor for unauthorized changes to powerd settings or system configuration files on pfSense hosts.
• Correlate administrative login events with subsequent command execution or configuration changes on the firewall.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.