CVE-2026-111224 in pfSense
Summary
by MITRE • 10/15/2026
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in pfSense Community Edition versions up to 2.9.0 represents a critical security flaw within the OpenVPN integration layer, specifically located in the openvpn.connect_async.sh script. This operating system command injection vulnerability arises from improper neutralization of special elements used in an OS command, commonly categorized under CWE-78: Improper Neutralization of Special Elements used in an Operating System Command. The root cause lies in how the script processes user-supplied input during the VPN connection and disconnection lifecycle. When a user authenticates via external methods such as RADIUS or LDAP, their username is passed into shell scripts that construct commands for pfctl, the packet filter control utility.
The technical mechanism of exploitation involves the injection of single quotes and other shell metacharacters within the authenticated username field. The script utilizes an eval command to process a pfctl anchor name derived from this username. Because the input is not adequately sanitized or escaped before being embedded into the evaluation string, attackers can break out of the intended context. By crafting usernames that include syntactic elements like single quotes followed by shell commands, an attacker can terminate the original argument and append arbitrary operating system commands to be executed with root privileges. This bypasses standard access controls because the execution occurs within a privileged script context managed by the pfSense firewall infrastructure.
The operational impact of this vulnerability is severe due to the privilege level at which the injected code executes. Since the openvpn.connect_async.sh script runs as root, any command injection results in full system compromise. An authenticated attacker can execute arbitrary commands with the highest level of access on the underlying FreeBSD operating system. This allows for complete control over the firewall appliance, including reading sensitive configuration files, modifying network rules to bypass security policies, installing persistent backdoors, or pivoting to other systems within the protected internal network. The vulnerability affects both connection and disconnection events, providing multiple opportunities for exploitation depending on how the VPN service is configured and accessed.
From a threat intelligence perspective, this flaw aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh or bash. It also reflects common patterns seen in web application and API vulnerabilities where input validation fails to account for command-line syntax nuances. The reliance on external authentication providers like RADIUS or LDAP does not mitigate the risk because these systems typically transmit usernames without filtering for shell metacharacters, assuming the downstream applications will handle sanitization correctly.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply vendor-provided patches that update pfSense CE to a version newer than 2.9.0, where this input validation issue has been resolved by properly escaping or quoting user-supplied variables before they are passed to the eval function. In environments where immediate patching is not feasible, administrators should restrict VPN access to only trusted IP ranges using firewall rules and consider disabling external authentication methods if possible, though this may impact usability. Additionally, implementing strict input validation policies that reject usernames containing special characters such as single quotes, double quotes, semicolons, or pipe symbols can reduce the attack surface. Regular auditing of system logs for unusual command execution patterns associated with VPN services is also recommended to detect potential exploitation attempts early.