CVE-2026-111218 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Netgate pfSense Community Edition versions 2.7.0 through 2.9.0 represents a critical OS command injection flaw that stems from improper input validation and sanitization within the Traffic Shaper configuration interface. This specific weakness allows an authenticated user possessing only Traffic Shaper Limiters privileges to escalate their access rights significantly by executing arbitrary commands with root-level permissions. The core of the issue lies in how the system handles the limiter number field during deletion operations, specifically failing to properly quote or sanitize input before passing it to underlying shell utilities.
The technical mechanism of exploitation involves manipulating the internal state of a traffic shaper limiter. An attacker begins by editing an existing limiter and injecting a malicious payload into the hidden 'number' parameter associated with that limiter. This number field is typically used internally to identify specific queue structures managed by the system's packet filter engine. After setting this tainted value, the attacker proceeds to delete the limiter from the configuration interface. Upon deletion, the pfSense backend invokes the delete_queue function, which is responsible for removing the corresponding traffic control queues.
The critical failure occurs within the delete_queue function as it constructs a command string to interact with dnctl, the user-space utility used to manipulate FreeBSD's Dummynet packet shaping subsystem. Instead of safely passing the limiter number as an argument or using a method that prevents shell interpretation, the system passes the unquoted value directly into /bin/sh for execution via root privileges. Because the input is not sanitized against special shell characters such as semicolons, pipes, or backticks, any malicious content embedded in the limiter number field is interpreted by the shell rather than treated as a literal identifier. This allows an attacker to append arbitrary commands that are executed with the highest level of system authority.
From a classification perspective, this vulnerability aligns closely with CWE-78, which denotes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector is categorized under ATT&CK technique T1059, specifically sub-technique 004 for Unix Shell Commands, indicating that the attacker leverages shell interpretation to execute unauthorized operations. Furthermore, because the vulnerability requires authentication and specific privileges rather than being accessible to unauthenticated users or those with minimal guest access, it falls under CWE-269, Improper Privilege Management, highlighting a failure in enforcing least privilege principles within the application logic.
The operational impact of this flaw is severe due to the resulting full system compromise. An attacker who successfully exploits this vulnerability gains root access to the pfSense firewall appliance. This level of control enables the exfiltration of sensitive network configuration data, including SSL/TLS certificates and private keys stored on the device. It also permits the modification of firewall rules to bypass security controls, potentially allowing unauthorized external access to internal networks. Additionally, the attacker can install persistent backdoors, modify system binaries, or pivot into other segments of the protected network infrastructure, effectively neutralizing the primary purpose of the firewall appliance.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade pfSense CE to a version that includes patches for this specific command injection flaw, ensuring that input validation routines are correctly implemented in the delete_queue function. Developers should enforce strict allow-listing of characters permitted in numeric fields or utilize parameterized execution methods that bypass shell interpretation entirely when invoking external utilities like dnctl. For organizations unable to immediately patch, restricting access to Traffic Shaper Limiters configuration pages to only those users with full administrative privileges can reduce the attack surface by limiting exposure to lower-privileged accounts. Continuous monitoring of system logs for unusual command executions or unexpected changes in traffic shaping configurations is also recommended to detect potential exploitation attempts.