What is the CVSS score of CVE-2026-45255?

CVE-2026-45255 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD are affected by CVE-2026-45255?

A command injection vulnerability in FreeBSD's bsdinstall and bsdconfig utilities enables adjacent network attackers to seize root-level control during system deployment through a rogue Wi-Fi access…

How to fix or mitigate CVE-2026-45255?

Within 24 hours, inventory FreeBSD systems currently using bsdinstall(8) or bsdconfig(8) to establish deployment scope. Within 7 days, restrict network access during system installations by air-gapping systems or using hardwired connections only, and implement Wi-Fi access point monitoring in deployment environments. Within 30 days, subscribe to FreeBSD security advisories for patch availability and evaluate configuration management tools or alternative deployment methods to minimize direct reliance on bsdinstall and bsdconfig.

FreeBSD CVE-2026-45255

EUVD-2026-31263 HIGH

OS Command Injection (CWE-78)

2026-05-21 freebsd

GHSA-qj4f-cpgw-vqx9

Command Injection Freebsd

7.5

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

AV:A and AC:H for required Wi-Fi proximity and scan-window timing; PR:N as no auth is needed; UI:R because a local operator must actively trigger the scan; C/I/A:H for root code execution.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:31 vuln.today

CVE Published

May 21, 2026 - 09:27 nvd

UNKNOWN (no severity yet)

CVE Published

May 21, 2026 - 09:27 cve.org

HIGH 7.5

DescriptionCVE.org

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell.

The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network.

AnalysisAI

Command injection in FreeBSD's bsdinstall(8) and bsdconfig(8) utilities allows an adjacent attacker to execute arbitrary code as root by broadcasting a Wi-Fi access point with a maliciously crafted SSID. The vulnerable shell script builds a network-selection menu without quoting network names, so a shell metacharacter-laden SSID is expanded and executed the moment an operator triggers a Wi-Fi scan - no need to select the rogue network. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with the CISA SSVC assessment of no observed exploitation.

Technical ContextAI

The flaw lives in the FreeBSD base-system shell scripts backing bsdinstall (the OS installer) and bsdconfig (post-install configuration), which use bsddialog(1) to render a menu of scanned Wi-Fi SSIDs. Because the code interpolates attacker-controlled network names into a shell context without proper quoting or sanitization, it is a classic CWE-78 OS Command Injection: unquoted 802.11 SSID strings undergo shell word-splitting and command substitution (e.g. via $(...) or backticks). The affected CPE is cpe:2.3:a:freebsd:freebsd, and since these utilities run with root privileges during install/configuration, injected commands inherit full root authority.

RemediationAI

Apply the vendor patch by updating to the fixed patch levels: FreeBSD 14.3-RELEASE-p14, 14.4-RELEASE-p5, or 15.0-RELEASE-p9 or later, using freebsd-update or a source rebuild as described in FreeBSD-SA-26:23.bsdinstall (https://security.freebsd.org/advisories/FreeBSD-SA-26:23.bsdinstall.asc). Where patching cannot be done immediately, the practical compensating control is to avoid using the Wi-Fi network-scan feature of bsdinstall/bsdconfig in untrusted RF environments - configure networking manually (wired connection or hand-entered SSID) rather than invoking the scan-and-select menu, since the injection triggers on scan alone; the trade-off is loss of the interactive scan convenience. Physically performing installation/configuration in an RF-controlled or shielded location where no rogue access points can be in range also neutralizes the adjacent attack vector.