PT-2018-13445 · Ipfire · Ipfire

Reginald Dodd · Published 2018-10-17 · Updated 2019-10-03 · CVE-2018-16232

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPFire Firewall versions prior to 2.21 Core Update 124

Description An authenticated command injection issue exists in the backup.cgi page, allowing an authenticated user with privileges for the affected page to execute arbitrary commands.

Recommendations For versions prior to 2.21 Core Update 124, update to version 2.21 Core Update 124 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup.cgi page to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-16232

Affected Products

Ipfire

References · 4

• 🔥 https://doddsecurity.com/213/command-injection-on-ipfire-firewalls · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16232 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16232 · Vendor Advisory
• https://ipfire.org/news/ipfire-2-21-core-update-124-released · Vendor Advisory