CVE-2026-111220 in pfSense CE
Summary
by MITRE • 10/15/2026
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in pfSense Community Edition versions through 2.9.0 represents a critical server-side request forgery and command injection flaw located within the network interface configuration module. Specifically, the defect resides in the interfaces_ppps_edit.php script, which is responsible for managing Point-to-Point Protocol (PPP) settings. This vulnerability allows authenticated users with specific administrative privileges to escalate their access rights significantly by exploiting improper input validation mechanisms during the scheduling of cron jobs associated with PPP interface resets or identifiers. The core technical flaw stems from the failure to sanitize special characters, particularly newline sequences, within user-supplied fields such as ptpid and reset hour/minute parameters before they are processed for system configuration tasks.
When an attacker submits crafted POST requests containing injected newlines into these specific input fields, the backend function configure_cron() fails to escape or properly validate this data prior to writing it directly into the /etc/crontab file on the underlying FreeBSD operating system. Because pfSense operates with elevated privileges and relies heavily on cron for routine maintenance tasks like interface resets, log rotations, and status updates, any modification to crontab is executed by the root user without further permission checks. Consequently, an attacker can insert arbitrary shell commands that will be scheduled and subsequently executed with full root-level permissions. This effectively bypasses all intended access controls within the web administration console, granting the adversary complete control over the network security appliance.
The operational impact of this vulnerability is severe, as it compromises the integrity, availability, and confidentiality of the entire network infrastructure protected by pfSense. An attacker who gains authenticated access to the PPP editing interface can establish persistent backdoors, exfiltrate sensitive network data, pivot into internal networks, or disrupt critical services by modifying system schedules. This capability undermines the fundamental security boundary between administrative users and the underlying operating system. The vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection, specifically occurring through a web application interface that interacts directly with system-level configuration files without adequate sanitization.
From a threat intelligence perspective, this exploitation technique maps to the MITRE ATT&CK framework under techniques such as T1053 Scheduled Task/Job which involves creating or modifying scheduled tasks for persistence and execution control, and potentially T1498 Network Denial of Service if the injected commands are designed to disrupt services. The attack vector is classified as Local with High Privileges required initially but resulting in Root-level compromise, highlighting the danger of privilege escalation through configuration management interfaces. Organizations running affected versions must treat this as a critical priority for remediation due to the direct path from authenticated web access to full system control.
Mitigation strategies should focus on immediate patching and strict input validation practices. The primary remedy is to upgrade pfSense CE to version 2.9.1 or later, where developers have implemented proper escaping of special characters within the configure_cron function and enforced stricter type checking for numeric fields like hour and minute values. In environments where upgrading is not immediately feasible, administrators should restrict access to the WebCfg - Interfaces: PPPs: Edit privilege set to only those users who absolutely require it, thereby reducing the attack surface. Additionally, implementing network segmentation to isolate the management interface from untrusted networks can provide a layer of defense-in-depth against exploitation attempts originating from external sources or compromised internal hosts with limited credentials.