Is CVE-2018-16055 actively exploited?

No active exploitation of CVE-2018-16055 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2018-16055 be exploited remotely?

Yes. CVE-2018-16055 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2018-16055?

CVE-2018-16055 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2018-16055

HIGH

CVE-2018-16055

CWE-78Published: September 26, 2018· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root user when submitting a request to relinquish a DHCP lease for an interface which is configured to obtain its address via DHCP.

NVD Source

Technical Analysis

CVE-2018-16055 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.