CVE-2026-111216 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Netgate pfSense Community Edition versions through 2.9.0 represents a critical OS command injection flaw that stems from insufficient input validation within the network gateway configuration interface. This specific weakness allows authenticated users who possess gateway edit privileges to execute arbitrary commands with root-level permissions on the underlying operating system. The core of the issue lies in how the system handles IPv6 link-local zone indices when configuring gateway monitoring parameters. In standard networking, an IPv6 link-local address is scoped to a particular network interface or zone and requires a zone index for proper routing resolution. pfSense utilizes this mechanism by allowing administrators to specify monitor IPs for gateways to ensure high availability and failover capabilities. However, the implementation fails to properly sanitize or escape special shell metacharacters within these inputs before passing them to system utilities.
The technical execution of this vulnerability centers on the start_dpinger function, which is responsible for initiating the dpinger daemon used for gateway monitoring. When an administrator sets a Monitor IP that includes an unvalidated zone index containing malicious payload data, the application passes this input directly into a shell command without adequate escaping. Because the dpinger utility operates with elevated privileges to perform network diagnostics and status checks, any injected commands are executed in the context of the root user. This lack of separation between configuration validation and system execution creates a direct path for remote code execution, provided the attacker has valid credentials with sufficient permissions to modify gateway settings. The vulnerability is particularly dangerous because it does not require complex exploitation techniques; rather, it relies on the straightforward injection of shell metacharacters such as semicolons or pipes into the zone index field, which are then interpreted by the underlying shell environment during the monitoring process.
From an operational impact perspective, this flaw compromises the integrity and confidentiality of the entire firewall infrastructure. An attacker who exploits this vulnerability gains full control over the pfSense appliance, enabling them to modify network rules, exfiltrate sensitive data, install persistent backdoors, or pivot into internal networks protected by the firewall. Since the privilege escalation is implicit due to the root execution context of dpinger, there are no additional steps required for privilege elevation beyond gaining initial authenticated access with gateway edit rights. This significantly lowers the barrier for exploitation and increases the severity of the risk associated with any compromised administrative account that has been granted these specific permissions. The impact extends beyond immediate system compromise, as it can lead to widespread network disruption or data breaches depending on the role of the pfSense device within the organization's architecture.
To mitigate this vulnerability, administrators should immediately apply the latest security patches provided by Netgate for pfSense CE versions 2.9.0 and earlier. It is crucial to verify that all instances of pfSense are updated to a version where input validation has been strengthened in the gateway configuration module. In addition to patching, organizations should enforce strict access control policies regarding who holds gateway edit privileges, adhering to the principle of least privilege by restricting such rights only to essential personnel. Network segmentation and monitoring for anomalous outbound connections or unusual process executions can also aid in detecting potential exploitation attempts. Furthermore, reviewing audit logs for changes made to gateway configurations during periods of suspected compromise is recommended to assess whether this vulnerability has been exploited in any specific environment.