Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
204 vulnerabilities by Netgate
CVE-2026-111233 (GCVE-0-2026-111233)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:02
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
Summary
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-rules-if-xss | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.1 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:01:36.630601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:02:04.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:20:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:32.907Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-rules-if-xss"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L138-L146"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L391"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-reflected-xss-via-firewall-rules-php"
}
],
"title": "Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111233",
"datePublished": "2026-10-15T18:46:32.907Z",
"dateReserved": "2026-10-15T18:21:24.701Z",
"dateUpdated": "2026-10-15T20:02:04.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111232 (GCVE-0-2026-111232)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Summary
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-separator-color-xss | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.3.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:20
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:20:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators\u0027 browsers to perform WebGUI actions with their privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:32.161Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-separator-color-xss"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color"
}
],
"title": "Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111232",
"datePublished": "2026-10-15T18:46:32.161Z",
"dateReserved": "2026-10-15T18:21:24.351Z",
"dateUpdated": "2026-10-15T18:46:32.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111231 (GCVE-0-2026-111231)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Summary
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-config-readonl… | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:21
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:21:08.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the \u0027User - Config: Deny Config Write\u0027 privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:31.461Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-config-readonly-restore"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L743-L798"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L588-L597"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-authorization-bypass-via-config-restore-and-config-install"
}
],
"title": "Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111231",
"datePublished": "2026-10-15T18:46:31.461Z",
"dateReserved": "2026-10-15T18:21:23.999Z",
"dateUpdated": "2026-10-15T18:46:31.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111230 (GCVE-0-2026-111230)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:48
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
Summary
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:48 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-dyndns-file | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:48:22.238564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:31.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:30.758Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-dyndns-file"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L598-L616"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L2151-L2171"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_dyndns_edit.php#L138-L141"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-local-file-read-via-dynamic-dns-update-url"
}
],
"title": "Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111230",
"datePublished": "2026-10-15T18:46:30.758Z",
"dateReserved": "2026-10-15T18:21:23.659Z",
"dateUpdated": "2026-10-15T19:48:31.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111229 (GCVE-0-2026-111229)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Summary
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-cp-ha-pfctl | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:17.145241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:20.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:30.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-cp-ha-pfctl"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/captiveportal.inc#L2958-L2966"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_captiveportal_hasync.php#L106-L140"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-captive-portal-ha-sync"
}
],
"title": "Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111229",
"datePublished": "2026-10-15T18:46:30.058Z",
"dateReserved": "2026-10-15T18:21:23.312Z",
"dateUpdated": "2026-10-16T17:11:20.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111228 (GCVE-0-2026-111228)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:02
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
Summary
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:02 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-unbound-sock-timeout | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.1 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:02:29.677101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:02:39.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:29.375Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-unbound-sock-timeout"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_unbound_advanced.php#L178"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/unbound.inc#L590"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-crlf-injection-via-services-unbound-advanced-php"
}
],
"title": "Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111228",
"datePublished": "2026-10-15T18:46:29.375Z",
"dateReserved": "2026-10-15T18:21:22.947Z",
"dateUpdated": "2026-10-15T20:02:39.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111227 (GCVE-0-2026-111227)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
Summary
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Severity
5.5 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-unbound-acl-crlf | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:26.531Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-unbound-acl-crlf"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/unbound.inc#L1094-L1112"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_unbound_acls.php#L121-L142"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crlf-injection-via-services-unbound-acls-php"
}
],
"title": "Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111227",
"datePublished": "2026-10-15T18:46:26.531Z",
"dateReserved": "2026-10-15T18:21:22.605Z",
"dateUpdated": "2026-10-15T18:46:26.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111226 (GCVE-0-2026-111226)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
Summary
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-sshguard-crlf | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.4.5 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.4.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:25.792Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-sshguard-crlf"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php"
}
],
"title": "Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111226",
"datePublished": "2026-10-15T18:46:25.792Z",
"dateReserved": "2026-10-15T18:21:22.260Z",
"dateUpdated": "2026-10-15T18:46:25.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111225 (GCVE-0-2026-111225)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:48
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
Summary
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:48 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-ovpn-learn-cn | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.5.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:48:50.888190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:58.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:25.093Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-ovpn-learn-cn"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.learn-address.sh#L57-L62"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.5.0-through-2.9.0-os-command-injection-via-openvpn-learn-address-sh"
}
],
"title": "Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111225",
"datePublished": "2026-10-15T18:46:25.093Z",
"dateReserved": "2026-10-15T18:21:21.906Z",
"dateUpdated": "2026-10-15T19:48:58.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111224 (GCVE-0-2026-111224)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
Summary
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-ovpn-connect-eval | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:15.607344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:27.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval\u0027d pfctl anchor name on connect or disconnect."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:24.410Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-ovpn-connect-eval"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.connect_async.sh#L83-L114"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-openvpn-connect-async-sh"
}
],
"title": "Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111224",
"datePublished": "2026-10-15T18:46:24.410Z",
"dateReserved": "2026-10-15T18:21:21.555Z",
"dateUpdated": "2026-10-16T17:11:27.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111223 (GCVE-0-2026-111223)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:04
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
Summary
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:03 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-ipsec-login-banner | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://abraxaslabs.tech/research/pfsense-ipsec-l… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/commit/27a52d0807 | technical-descriptionpatch |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 15:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:03:03.449675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:04:59.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T15:55:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing \u0027}\u0027 to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:23.730Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-ipsec-login-banner"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ipsec-login-banner"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-L1388"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-L1845"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_mobile.php#L269-L273"
},
{
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/pfsense/pfsense/commit/27a52d0807"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobile-login-banner"
}
],
"title": "Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111223",
"datePublished": "2026-10-15T18:46:23.730Z",
"dateReserved": "2026-10-15T18:21:21.197Z",
"dateUpdated": "2026-10-15T20:04:59.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111222 (GCVE-0-2026-111222)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Summary
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
Severity
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-timezone-phpini | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:47.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:23.081Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-timezone-phpini"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/system.php#L288"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/system.inc#L2377-L2380"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L163-L166"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L220"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-php-ini-injection-via-timezone-setting"
}
],
"title": "Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111222",
"datePublished": "2026-10-15T18:46:23.081Z",
"dateReserved": "2026-10-15T18:21:20.824Z",
"dateUpdated": "2026-10-15T18:46:23.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111221 (GCVE-0-2026-111221)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
Summary
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
Severity
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-l2tp-radius-mpd | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:21.847Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-l2tp-radius-mpd"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L428-L441"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L202-L215"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_l2tp.php#L137-L143"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-radius-secret-mpd-conf-injection"
}
],
"title": "Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111221",
"datePublished": "2026-10-15T18:46:21.847Z",
"dateReserved": "2026-10-15T18:21:20.429Z",
"dateUpdated": "2026-10-15T18:46:21.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111220 (GCVE-0-2026-111220)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:49
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
Summary
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:49 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-pppoe-cron | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:49:15.335826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:49:22.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the \u0027WebCfg - Interfaces: PPPs: Edit\u0027 privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:21.230Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-pppoe-cron"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L2174-L2214"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_ppps_edit.php#L271-L278"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/services.inc#L5652-L5660"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crontab-injection-via-ppp-periodic-reset-ptpid"
}
],
"title": "Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111220",
"datePublished": "2026-10-15T18:46:21.230Z",
"dateReserved": "2026-10-15T18:21:20.012Z",
"dateUpdated": "2026-10-15T19:49:22.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111219 (GCVE-0-2026-111219)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
Summary
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-pppoe-secret-bang | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111219",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:14.127629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:33.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:49:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with \u0027!\u0027, making mpd5 run commands as root when a PPPoE client authenticates."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:20.608Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-pppoe-secret-bang"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L272-L282"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_pppoe_edit.php#L141-L152"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-pppoe-server-username"
}
],
"title": "Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111219",
"datePublished": "2026-10-15T18:46:20.608Z",
"dateReserved": "2026-10-15T18:21:19.617Z",
"dateUpdated": "2026-10-16T17:11:33.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111218 (GCVE-0-2026-111218)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:07
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Summary
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:05 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-limiter-number | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://abraxaslabs.tech/research/pfsense-limiter… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 15:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111218",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:05:36.819673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:07:51.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T15:55:45.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden \u0027number\u0027 value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:19.971Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-limiter-number"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-limiter-number"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-traffic-shaper-limiters"
}
],
"title": "Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111218",
"datePublished": "2026-10-15T18:46:19.971Z",
"dateReserved": "2026-10-15T18:21:18.816Z",
"dateUpdated": "2026-10-15T20:07:51.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111217 (GCVE-0-2026-111217)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Summary
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-carp-vhid | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://abraxaslabs.tech/research/pfsense-carp-vhid | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 15:55
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T15:55:45.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:19.325Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-carp-vhid"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-carp-vhid"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid"
}
],
"title": "Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111217",
"datePublished": "2026-10-15T18:46:19.325Z",
"dateReserved": "2026-10-15T18:21:18.453Z",
"dateUpdated": "2026-10-15T18:46:19.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111216 (GCVE-0-2026-111216)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
Summary
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-gw-ipv6-zone | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:47.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:18.645Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-gw-ipv6-zone"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/util.inc#L1418"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/gwlb.inc#L535"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-gateway-monitor-ip"
}
],
"title": "Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111216",
"datePublished": "2026-10-15T18:46:18.645Z",
"dateReserved": "2026-10-15T18:21:18.103Z",
"dateUpdated": "2026-10-15T18:46:18.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111215 (GCVE-0-2026-111215)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:43
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Summary
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-wireless-clone | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/abraxas/pfsense-assign-if-add | exploittechnical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 03:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111215",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:43:24.462899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:43:31.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T03:28:05.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;\u003ccmd\u003e via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:17.986Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-wireless-clone"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-assign-if-add"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3370"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_wireless_edit.php#L77"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_assign.php#L187"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-wireless-parent-interface"
}
],
"title": "Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111215",
"datePublished": "2026-10-15T18:46:17.986Z",
"dateReserved": "2026-10-15T18:21:17.747Z",
"dateUpdated": "2026-10-15T19:43:31.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111214 (GCVE-0-2026-111214)
Vulnerability from nvd – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Summary
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-qinq-parent-if | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://abraxaslabs.tech/research/pfsense-qinq-pa… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 15:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111214",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:12.622142Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:40.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T15:55:45.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted \u0027if\u0027 value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:17.293Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-qinq-parent-if"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-qinq-parent-if"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L136"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L212"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L620"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-interfaces-qinq-edit-php"
}
],
"title": "Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111214",
"datePublished": "2026-10-15T18:46:17.293Z",
"dateReserved": "2026-10-15T18:21:16.320Z",
"dateUpdated": "2026-10-16T17:11:40.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111233 (GCVE-0-2026-111233)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:02
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
Summary
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-rules-if-xss | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.1 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:01:36.630601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:02:04.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:20:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:32.907Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-rules-if-xss"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L138-L146"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L391"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-reflected-xss-via-firewall-rules-php"
}
],
"title": "Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111233",
"datePublished": "2026-10-15T18:46:32.907Z",
"dateReserved": "2026-10-15T18:21:24.701Z",
"dateUpdated": "2026-10-15T20:02:04.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111232 (GCVE-0-2026-111232)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Summary
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-separator-color-xss | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.3.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:20
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:20:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators\u0027 browsers to perform WebGUI actions with their privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:32.161Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-separator-color-xss"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color"
}
],
"title": "Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111232",
"datePublished": "2026-10-15T18:46:32.161Z",
"dateReserved": "2026-10-15T18:21:24.351Z",
"dateUpdated": "2026-10-15T18:46:32.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111231 (GCVE-0-2026-111231)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Summary
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-config-readonl… | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:21
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T17:21:08.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the \u0027User - Config: Deny Config Write\u0027 privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:31.461Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-config-readonly-restore"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L743-L798"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L588-L597"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-authorization-bypass-via-config-restore-and-config-install"
}
],
"title": "Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111231",
"datePublished": "2026-10-15T18:46:31.461Z",
"dateReserved": "2026-10-15T18:21:23.999Z",
"dateUpdated": "2026-10-15T18:46:31.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111230 (GCVE-0-2026-111230)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:48
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
Summary
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:48 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-dyndns-file | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:48:22.238564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:31.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:30.758Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-dyndns-file"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L598-L616"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dyndns.class#L2151-L2171"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_dyndns_edit.php#L138-L141"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-local-file-read-via-dynamic-dns-update-url"
}
],
"title": "Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111230",
"datePublished": "2026-10-15T18:46:30.758Z",
"dateReserved": "2026-10-15T18:21:23.659Z",
"dateUpdated": "2026-10-15T19:48:31.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111229 (GCVE-0-2026-111229)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Summary
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-cp-ha-pfctl | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:17.145241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:20.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:30.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-cp-ha-pfctl"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/captiveportal.inc#L2958-L2966"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_captiveportal_hasync.php#L106-L140"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-captive-portal-ha-sync"
}
],
"title": "Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111229",
"datePublished": "2026-10-15T18:46:30.058Z",
"dateReserved": "2026-10-15T18:21:23.312Z",
"dateUpdated": "2026-10-16T17:11:20.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111228 (GCVE-0-2026-111228)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 20:02
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
Summary
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:02 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-unbound-sock-timeout | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.7.1 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:02:29.677101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:02:39.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:29.375Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-unbound-sock-timeout"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_unbound_advanced.php#L178"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/unbound.inc#L590"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-crlf-injection-via-services-unbound-advanced-php"
}
],
"title": "Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111228",
"datePublished": "2026-10-15T18:46:29.375Z",
"dateReserved": "2026-10-15T18:21:22.947Z",
"dateUpdated": "2026-10-15T20:02:39.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111227 (GCVE-0-2026-111227)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
Summary
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Severity
5.5 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-unbound-acl-crlf | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:26.531Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-unbound-acl-crlf"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/unbound.inc#L1094-L1112"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_unbound_acls.php#L121-L142"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crlf-injection-via-services-unbound-acls-php"
}
],
"title": "Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111227",
"datePublished": "2026-10-15T18:46:26.531Z",
"dateReserved": "2026-10-15T18:21:22.605Z",
"dateUpdated": "2026-10-15T18:46:26.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111226 (GCVE-0-2026-111226)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
Summary
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-sshguard-crlf | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.4.5 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 04:48
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.4.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T04:48:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:25.792Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-sshguard-crlf"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php"
}
],
"title": "Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111226",
"datePublished": "2026-10-15T18:46:25.792Z",
"dateReserved": "2026-10-15T18:21:22.260Z",
"dateUpdated": "2026-10-15T18:46:25.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111225 (GCVE-0-2026-111225)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 19:48
VLAI
EPSS
VEX
Title
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
Summary
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:48 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-ovpn-learn-cn | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
2.5.0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:48:50.888190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:58.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:25.093Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-ovpn-learn-cn"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.learn-address.sh#L57-L62"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.5.0-through-2.9.0-os-command-injection-via-openvpn-learn-address-sh"
}
],
"title": "Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111225",
"datePublished": "2026-10-15T18:46:25.093Z",
"dateReserved": "2026-10-15T18:21:21.906Z",
"dateUpdated": "2026-10-15T19:48:58.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111224 (GCVE-0-2026-111224)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-16 17:11
VLAI
EPSS
VEX
Title
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
Summary
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:29 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/pfsense-ovpn-connect-eval | exploittechnical-description |
| https://abraxaslabs.tech/research/pfsense-ce-leftovers | technical-description |
| https://github.com/pfsense/pfsense/blob/9363ac5b8… | technical-description |
| https://www.vulncheck.com/advisories/netgate-pfse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Netgate | pfSense CE |
Affected:
0 , ≤ 2.9.0
(semver)
cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 05:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:29:15.607344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:27.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pfsense/pfsense",
"product": "pfSense CE",
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"versions": [
{
"lessThanOrEqual": "2.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-15T05:50:19.000Z",
"descriptions": [
{
"lang": "en",
"value": "pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval\u0027d pfctl anchor name on connect or disconnect."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:46:24.410Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/pfsense-ovpn-connect-eval"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.connect_async.sh#L83-L114"
},
{
"name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-openvpn-connect-async-sh"
}
],
"title": "Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111224",
"datePublished": "2026-10-15T18:46:24.410Z",
"dateReserved": "2026-10-15T18:21:21.555Z",
"dateUpdated": "2026-10-16T17:11:27.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}