Austin Ralls

**Name of the Vulnerable Software and Affected Versions** FreeBSD bsdinstall/bsdconfig (affected versions not specified) **Description** When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they compile a list of network names and use the `bsddialog(1)` function to prompt the user for selection. Because this process is implemented via a shell script that fails to prevent shell expansion of network names, a specially crafted network name can trigger command injection via a subshell. This allows an attacker within range of a Wi-Fi scan to execute arbitrary code as root. The issue is triggered as soon as the scan is initiated; the user does not need to select or connect to the malicious network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.