CVE-2026-111223 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Netgate pfSense Community Edition versions 2.7.0 through 2.9.0 represents a critical configuration injection flaw within the IPsec Mobile management interface. This security defect specifically targets authenticated users who possess IPsec Mobile privileges, allowing them to escalate their access rights significantly beyond what is intended by the system design. The core of the issue lies in how the pfSense web GUI handles user input for the login_banner field when generating configuration files for strongSwan, a widely used open-source Internet Key Exchange (IKE) protocol suite. Instead of properly sanitizing or escaping special characters within this banner text, the application directly embeds the unvalidated string into the strongswan.conf attribute value without adequate quoting mechanisms. This lack of input validation creates an opening for attackers to manipulate the structure of the configuration file itself rather than merely setting a display message.
From a technical perspective, the flaw exploits the parsing logic of the strongSwan daemon, specifically charon, which is responsible for managing IPsec connections and executing associated scripts. By submitting a carefully crafted single-line banner containing a closing brace character followed by specific command syntax, an attacker can break out of the intended string context within the configuration file. This escape allows the injection of arbitrary key-value pairs that are interpreted as valid strongSwan directives. Specifically, attackers can define charon.start-scripts entries, which instruct the daemon to execute external scripts or commands with root-level privileges whenever the service is restarted or reloaded. Since pfSense services typically run under elevated permissions to manage network interfaces and firewall rules, this mechanism effectively grants the attacker full administrative control over the underlying operating system without requiring additional authentication steps beyond their existing IPsec Mobile credentials.
The operational impact of this vulnerability is severe, as it facilitates a direct path from authenticated user access to root-level command execution on the gateway appliance. This capability undermines the fundamental security boundaries established by pfSense, allowing malicious actors to modify firewall rules, exfiltrate sensitive network data, install persistent backdoors, or pivot into internal networks protected by the compromised device. The attack vector is particularly dangerous because it relies on social engineering or credential theft rather than exploiting a remote code execution flaw in unauthenticated services; however, once an attacker obtains low-privileged IPsec Mobile credentials, which are often used for remote access scenarios, they can immediately escalate to full system compromise. This aligns with the Common Weakness Enumeration (CWE) category CWE-94 Improper Control of Generation of Code Command Injection, as well as CWE-78 Improper Neutralization of Special Elements used in an OS Command, highlighting the failure to properly sanitize user-supplied input before its inclusion in system commands or configuration files.
In terms of threat modeling and adversary behavior, this vulnerability maps directly to MITRE ATT&CK technique T1505.003 Server Software Component: IPsec Tunnel Endpoints, where attackers leverage legitimate infrastructure components for persistence or privilege escalation. It also relates to T1498 Network Denial of Service if the attacker chooses to disrupt service by corrupting configurations, though command execution is the primary concern here. The exploitation chain demonstrates how misconfigured web interfaces can serve as a bridge between application-layer access and operating-system-level control, emphasizing the importance of strict input validation in all administrative panels that generate system configuration files.
To mitigate this vulnerability, administrators must immediately upgrade pfSense CE to version 2.9.1 or later, where Netgate has implemented proper escaping and quoting mechanisms for the login_banner field within the strongSwan configuration generation process. Until an upgrade is feasible, organizations should restrict IPsec Mobile access to trusted networks only and enforce multi-factor authentication if available to reduce the risk of credential compromise. Additionally, reviewing user accounts with IPsec privileges ensures that no unnecessary high-privilege users exist in the system. Regular audits of strongSwan configuration files for unexpected start-scripts or anomalous entries can also help detect potential exploitation attempts early. Security teams should treat this incident as a reminder to enforce strict input validation and output encoding practices across all web-based management interfaces, particularly those that interact with low-level network daemons running under elevated privileges.