CVE-2026-110908 in pfSense
Summary
by MITRE • 10/15/2026
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the Netgate pfSense Free Range Routing package, specifically versions 2.0.2_1 through source revision 2.1.2_1, represents a critical OS command injection flaw within the FRR status filter functionality. This security defect allows an authenticated user with minimal privileges to execute arbitrary system commands on the underlying operating system as root. The vulnerability stems from improper input validation and sanitization practices in the web interface code that handles routing protocol status queries. Despite requiring authentication, the low privilege level required for exploitation makes this a significant risk to network infrastructure integrity, as it bypasses standard access control mechanisms designed to restrict users to read-only operational views.
The technical root cause lies in how user-supplied filter values are processed before being passed to system utilities. The application utilizes the PHP function escapeshellarg() to sanitize input intended for use within a shell command. However, this sanitized output is subsequently concatenated into a larger string that forms part of a sed expression enclosed in single quotes. This architectural decision creates a context where the escaping performed by escapeshellarg() is insufficient because it does not account for the specific parsing rules of the subsequent sed interpreter when embedded within single-quoted strings. An attacker can craft a filter value containing shell metacharacters that, while escaped for one layer of execution, break out of the intended string context due to the interaction between the escaping mechanism and the surrounding quote structure.
Once the input breaks out of the constrained expression, it is passed into a popen() pipeline which executes system commands with elevated privileges. The shell interprets the injected payload as valid command syntax, allowing for arbitrary code execution. This capability effectively grants the attacker full control over the pfSense firewall appliance, enabling them to modify network configurations, exfiltrate sensitive data, install persistent backdoors, or pivot into internal networks protected by the firewall. The impact is severe because it compromises the confidentiality, integrity, and availability of the entire security perimeter managed by the device.
This vulnerability aligns with Common Weakness Enumeration CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. From a tactical perspective, this exploit maps to MITRE ATT&CK technique T1059.004, specifically the use of Unix Shell Commands for execution. The attack vector is classified as Local with Low Complexity because it requires prior authentication but leverages a straightforward input manipulation that does not require complex exploitation chains or additional vulnerabilities in other components.
To mitigate this risk, administrators must immediately update the pfSense-pkg-frr package to version 26.07_1 for pfSense Plus or versions 2.9.0 and 2.8.1 for pfSense CE. These updated packages contain code changes that properly sanitize input before it is passed to system commands, ensuring that special characters are neutralized regardless of the surrounding string context. Until patches are applied, organizations should consider restricting access to the FRR status page in their web GUI configuration if possible, although this may not fully mitigate the risk given the low privilege requirement for exploitation. Regular auditing of user privileges and monitoring for unusual outbound network connections or system log anomalies can also help detect potential exploitation attempts during the remediation window.