CVE-2018-4020: pfSense CE admin interface command injection via powerd_ac_mode parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityAuthenticated remote command execution on a perimeter firewall with a high EPSS score and public exploit detail, though exploitation requires valid admin credentials.

What it is

Netgate pfSense CE 2.4.4-RELEASE fails to sanitize the powerd_ac_mode POST parameter, allowing OS command injection. An attacker who can send authenticated POST requests to the administration web interface can run arbitrary commands on the firewall. Because pfSense is typically a perimeter device, successful exploitation can compromise network security controls.

Impact

An attacker with admin web credentials gains arbitrary command execution as the web interface user, enabling full control of the firewall host, data theft, and use as a pivot into protected networks.

Attack surface

Reachable over the network through the pfSense administration web interface via a crafted POST request; the CVSS vector (AV:N/PR:H/UI:N) indicates valid administrative authentication is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.487 probability, 98.8th percentile) and the only references are Talos advisories tagged Exploit, indicating public exploit detail exists. No ransomware group use is documented.

What to do

• Upgrade pfSense CE to a release later than 2.4.4-RELEASE that fixes the powerd_ac_mode command injection.
• Restrict access to the administration web interface to trusted management networks or VPN, never expose it to the internet.
• Enforce strong unique admin credentials and multi-factor authentication where supported to limit abuse of authenticated attack paths.
• Audit and remove unnecessary admin accounts and review web interface access logs for anomalous POST requests.
• Monitor vendor advisories for pfSense updates and apply them promptly.

Detection

• Search web server or pfSense logs for POST requests containing powerd_ac_mode with shell metacharacters or unexpected values.
• Alert on child processes spawned by the web interface (e.g., shell, sh, or powerd-related commands) with unusual arguments.
• Monitor for outbound connections or new processes on the firewall host that do not match normal administrative activity.
• Correlate admin login events with subsequent command execution or configuration changes on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.