CVE-2026-111225 in pfSense
Summary
by MITRE • 10/15/2026
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Netgate pfSense Community Edition versions 2.5.0 through 2.9.0 represents a critical security flaw within the OpenVPN integration layer, specifically affecting the openvpn.learn-address.sh script. This component is responsible for handling dynamic address updates and client registration events when the DNS Resolver feature with unbound client registration is enabled. The core technical deficiency lies in improper neutralization of special elements used in shell commands, commonly categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. During the execution flow, user-supplied data derived from VPN connection parameters, such as the certificate common name or username provided during authentication, is interpolated directly into system calls without adequate sanitization or quoting mechanisms.
When a client connects to the OpenVPN server, pfSense invokes the learn-address script to register the client's IP address with the local DNS resolver. The script constructs commands using shell metacharacters that are passed from the environment variables populated by the VPN daemon. Because these values are embedded into su -c strings without proper escaping or quoting, an attacker who has successfully authenticated as a valid VPN user can inject arbitrary operating system commands. This exploitation vector allows for remote code execution with the privileges of the unbound user, which is typically assigned to run the DNS resolver service. While this privilege level may not immediately grant root access, it provides significant foothold capabilities within the network infrastructure.
The operational impact of this vulnerability extends beyond simple command execution. By leveraging OS command injection via CWE-78, an authenticated attacker can potentially pivot further into the internal network or escalate privileges to gain control over the pfSense firewall appliance itself. The ability to execute commands as the unbound user facilitates reconnaissance activities and may allow for manipulation of DNS resolution records, leading to potential phishing attacks or traffic interception if combined with other vulnerabilities. From a threat modeling perspective aligned with MITRE ATT&CK techniques, this flaw aligns with T1059 Command and Scripting Interpreter, specifically allowing adversaries to execute commands via shell mechanisms on compromised systems. It also relates to privilege escalation vectors where initial access through legitimate credentials is leveraged for deeper system compromise.
Mitigation strategies must address both the immediate technical fix and broader architectural controls. The primary remediation involves applying vendor-provided patches that update pfSense CE to a version beyond 2.9.0, which includes corrections to properly quote variables within shell scripts and enforce stricter input validation on data originating from VPN clients. Administrators should also consider disabling unbound client registration if it is not strictly required for their network operations, thereby removing the vulnerable code path entirely. Additionally, implementing strict certificate policies that limit or sanitize common name fields can reduce the attack surface. Regular auditing of openvpn configuration and script integrity checks are recommended to ensure no unauthorized modifications have been made to system scripts that could reintroduce similar injection flaws.