CVE-2026-111217 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Netgate pfSense Community Edition versions through 2.9.0 represents a critical security flaw rooted in insufficient input validation within the system's configuration management interface. Specifically, this OS command injection vulnerability targets authenticated users who possess Virtual IP edit privileges. The core technical failure lies in how the application handles the CARP VHID (Virtual Host ID) parameter during configuration updates and status rendering operations. When an administrator or authorized user attempts to modify a virtual IP address assignment, the system accepts input for the VHID field without adequately sanitizing shell metacharacters such as semicolons, pipes, or backticks. This lack of rigorous validation allows malicious payloads to be embedded directly into configuration variables that are subsequently passed to underlying operating system commands.
The exploitation mechanism operates through two primary code paths within the pfSense framework. First, when a user saves changes involving virtual IP aliases, the function interface_ipalias_configure() is invoked. This routine constructs and executes ifconfig commands using the provided VHID value as part of its arguments or environment variables. Because the input is not properly escaped before being passed to these system calls, an attacker can inject arbitrary shell commands that execute with root privileges on the underlying FreeBSD operating system. Second, the vulnerability extends to the status display logic via get_carp_interface_status(). When the web interface renders the current CARP (Common Address Redundancy Protocol) status for interfaces, it processes the VHID data again without sufficient sanitization, providing an alternative vector for command execution even if the initial configuration save is blocked or monitored.
The operational impact of this vulnerability is severe due to the privilege level achieved upon successful exploitation. Since pfSense functions as a firewall and router appliance, gaining root access allows an attacker to completely compromise the integrity, confidentiality, and availability of the network infrastructure. An adversary could modify routing tables, disable security rulesets, install persistent backdoors, or pivot into internal networks protected by the compromised device. This effectively neutralizes the primary purpose of the appliance, turning a defensive tool into a vector for further attacks against connected systems. The requirement for authentication does not mitigate this risk significantly in environments where administrative credentials may be weak, shared, or stolen through other means such as phishing or credential stuffing attacks.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the execution of system commands via injected input. The attack vector is classified as Local or Network depending on whether authentication can be achieved remotely with valid credentials, but it fundamentally relies on user interaction within a privileged administrative context rather than an unauthenticated remote exploit.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to apply the vendor-provided patch that updates pfSense CE to version 2.9.1 or later, which includes proper input validation and escaping mechanisms for VHID parameters in all relevant code paths. In environments where patching cannot be immediately performed, network segmentation should be enforced to restrict access to the management interface of affected devices strictly from trusted administrative subnets. Additionally, implementing strict role-based access control ensures that only essential personnel have Virtual IP edit privileges, thereby reducing the attack surface. Regular auditing of configuration changes and monitoring for anomalous system command executions can also aid in early detection of exploitation attempts.