{"metadata": {"vulnerability": "CVE-2026-111223", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-13T15:55:44Z", "date_only": false, "value": "2026-10-13T15:55:44.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111223", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-15T18:21:21.197Z", "date_only": false, "value": "2026-10-15T18:21:21.197Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111223", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T18:46:23.730Z", "date_only": false, "value": "2026-10-15T18:46:23.730Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111223", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T18:46:23.730Z", "date_only": false, "value": "2026-10-15T18:46:23.730Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111223", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T19:02:41.608Z", "date_only": false, "value": "2026-10-15T19:02:41.608744Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117446473227712094", "record": "CVE-2026-111223", "field": "creation_timestamp", "uuid": "2ffa826b-774e-4d37-a074-790628287555", "content": "CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111223https://github.com/abraxas/pfsense-ipsec-login-bannerhttps://abraxaslabs.tech/research/pfsense-ce-leftovershttps://abraxaslabs.tech/research/pfsense-ipsec-login-bannerhttps://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-L1388https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-L1845https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_mobile.php#L269-L273https://github.com/pfsense/pfsense/commit/27a52d0807https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobile-login-banner#Netgate #pfSenseCE#CVE_2026_111223#bot", "url": "https://infosec.exchange/users/cve/statuses/117446473227712094"}, {"timestamp": "2026-10-15T19:17:34Z", "date_only": false, "value": "2026-10-15T19:17:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-743J-3P3M-6H73", "record": "GHSA-743J-3P3M-6H73", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T19:17:34.943Z", "date_only": false, "value": "2026-10-15T19:17:34.943", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111223", "record": "FKIE_CVE-2026-111223", "field": "published"}, {"timestamp": "2026-10-15T20:03:03.449Z", "date_only": false, "value": "2026-10-15T20:03:03.449675Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111223", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T20:03:03.449Z", "date_only": false, "value": "2026-10-15T20:03:03.449675Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111223", "record": "FKIE_CVE-2026-111223", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T20:04:59.913Z", "date_only": false, "value": "2026-10-15T20:04:59.913Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111223", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T20:04:59.913Z", "date_only": false, "value": "2026-10-15T20:04:59.913Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111223", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T21:05:32.823Z", "date_only": false, "value": "2026-10-15T21:05:32.823", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111223", "record": "FKIE_CVE-2026-111223", "field": "lastModified"}, {"timestamp": "2026-10-15T21:36:11Z", "date_only": false, "value": "2026-10-15T21:36:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-743J-3P3M-6H73", "record": "GHSA-743J-3P3M-6H73", "field": "published"}, {"timestamp": "2026-10-15T21:36:11Z", "date_only": false, "value": "2026-10-15T21:36:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-743J-3P3M-6H73", "record": "GHSA-743J-3P3M-6H73", "field": "modified"}, {"timestamp": "2026-10-17T03:30:05.323Z", "date_only": false, "value": "2026-10-17T03:30:05.323567Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my25msq3dc2h", "record": "CVE-2026-111223", "field": "creation_timestamp", "uuid": "f2a51b92-19e0-49c9-9e11-74d1484eb3d4", "content": "CVE-2026-111223 - pfsense ce\nVersions 2.7.0 through 2.9.0 of pfSense CE let a user with IPsec mobile rights add a special login banner that runs system commands with full control. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pfsensece #netgate #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my25msq3dc2h"}]}