CVE-2026-45255 Details
Description
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network.
A remote code execution vulnerability exists in FreeBSD's bsdinstall and bsdconfig utilities when they scan for nearby Wi-Fi networks. This issue arises because the network names are not properly sanitized, allowing a crafted name to execute commands through a subshell. The vulnerability can be exploited to execute code as root on the system. An attacker must create an access point with a maliciously crafted name and be within range for the Wi-Fi scan. The vulnerability is triggered as soon as the scan is initiated, without the need to select the malicious network.
Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:23.bsdinstall.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 14.3 - 14.3 p1 14.3 p10 14.3 p11 14.3 p12 14.3 p13 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 p1 14.4 p2 14.4 p3 14.4 p4 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 15.0 p5 15.0 p6 15.0 p7 15.0 p8 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | [email protected] |