CVE-2026-45255
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.
Risk Assessment
The risk involves potential remote code execution as root by an attacker within Wi-Fi range, which could lead to full system compromise.
Recommendation
Immediately update the FreeBSD system to a version that includes a fix for this vulnerability, and avoid scanning Wi-Fi networks in untrusted locations.
Other vulnerabilities in FreeBSD
See all- CVE-2017-1087High
In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, allowing processes in one jail to read and modify the content of POSIX shared memory objects created by processes in another jail or the host system.
- CVE-2016-1882High
FreeBSD versions 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.
- CVE-2015-1414High
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10, 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
- CVE-2026-49419High
Vulnerability in FreeBSD's kern_jail_set() and kern_jail_get() when the JAIL_AT_DESC flag is used. Double release of the caller's current prison reference can lead to a reference count underflow and use-after-free.
- CVE-2026-49418High
Vulnerability in FreeBSD kernel when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object. Physical pages are marked invalid but remain in the pager's list, leading to a double free on object destruction.
- CVE-2026-49415High
Vulnerability in FreeBSD during execve(2) of SUID binaries. The new virtual address space is installed before credentials are updated, allowing another process of the same user to access memory via procfs or linprocfs.
- CVE-2026-45259Medium
A vulnerability in the sigqueue(2) implementation in FreeBSD allows a process in capability mode to send signals to any process, bypassing Capsicum sandbox restrictions. The missing check for the target PID being the calling process's own enables an attacker to interfere with other processes.
- CVE-1999-0963High
The mount_union command in FreeBSD allows local users to gain root privileges via a symlink attack.
- CVE-1999-0052High
CVE-1999-0052 concerns IP fragmentation in FreeBSD that can lead to system crashes. A remote attacker can exploit this vulnerability to cause unexpected system downtime.
- CVE-1999-0053Medium
CVE-1999-0053 is a denial of service (DoS) vulnerability in FreeBSD that exploits TCP RST packets. An attacker can remotely initiate a connection reset, leading to service disruption.
Original NVD description (English source)
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network.