CVE-2026-111214 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability in Netgate pfSense Community Edition versions 2.7.0 through 2.9.0 represents a critical OS command injection flaw rooted in insufficient input validation within the network interface configuration subsystem. This specific weakness allows authenticated users who possess QinQ edit privileges to execute arbitrary operating system commands with root-level permissions. The core technical failure lies in how the software handles parent interface names during the creation and modification of QinQ (802.1ad) VLAN interfaces. When a user specifies a parent interface, the application fails to strictly validate or sanitize this input against an allowlist of known valid network interfaces before passing it into shell commands for system configuration.
The exploitation mechanism relies on the interpolation of unvalidated user-supplied data directly into command-line arguments used by ifconfig and related networking utilities. An attacker with QinQ edit privileges can initially save a crafted value in the parent interface field, effectively poisoning the input stream. Subsequently, when editing or applying changes to the QinQ entry, this maliciously stored string is interpolated into shell commands without proper escaping or filtering. This allows the injection of additional command-line arguments that are executed by the underlying operating system with the privileges of the pfSense service account, which typically operates as root on FreeBSD-based systems.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The flaw is not merely a logic error but a fundamental failure to enforce strict input validation boundaries for data that influences system-level operations. In the context of the MITRE ATT&CK framework, this vulnerability facilitates privilege escalation and command execution techniques often associated with lateral movement or persistence establishment within compromised networks. Attackers can leverage this capability to gain full control over the firewall appliance, bypassing standard authentication mechanisms due to the pre-existing authenticated state required for QinQ editing privileges.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of the entire network infrastructure protected by pfSense. Once an attacker achieves root-level command execution on the firewall, they can modify routing tables, install backdoors, exfiltrate sensitive traffic data, or pivot to other internal systems that rely on the firewall for security policies. This effectively neutralizes the primary defense mechanism of the network segment, allowing unrestricted access to protected resources and potentially leading to complete network compromise.
Mitigation strategies must focus on immediate remediation through software updates as well as strict administrative controls until patches are applied. Netgate has released updated versions that address this input validation deficiency by implementing rigorous allowlisting for parent interface names and ensuring proper sanitization of all user inputs before shell command execution. Administrators should immediately upgrade to a patched version of pfSense CE outside the affected range of 2.7.0 through 2.9.0. In environments where immediate patching is not feasible, restricting QinQ edit privileges to only those administrators who absolutely require them can reduce the attack surface. Additionally, implementing network segmentation and monitoring for unusual outbound connections from firewall management interfaces may help detect exploitation attempts early. Regular auditing of user permissions and enforcing least-privilege principles are essential long-term practices to prevent similar command injection vulnerabilities in future software versions.