CVE-2026-111227 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Netgate pfSense Community Edition versions through 2.9.0 represents a critical security flaw within the Unbound DNS resolver configuration interface. Specifically located in the services_unbound_acls.php script, this issue stems from insufficient input validation when handling user-supplied data for access list management. The core technical failure is a Carriage Return and Line Feed (CRLF) injection vulnerability that permits authenticated users possessing the DNS Resolver Access Lists privilege to manipulate the underlying configuration files of the Unbound service. By injecting CR/LF characters into the aclname or aclaction fields, an attacker can break out of the intended data structure and append arbitrary directives directly to the access_lists.conf file. This lack of sanitization allows for the injection of complex configuration commands such as local-data, local-zone, or forward-zone, which are normally reserved for system administrators with higher privileges.
From a technical perspective, this flaw exploits the way the web interface processes form submissions and writes them to disk without properly escaping special characters that denote line breaks in configuration files. In many Unix-like systems, including those running pfSense, configuration parsers rely on newlines to separate distinct directives. When an attacker injects these control characters, they effectively create a syntax break that allows subsequent text to be interpreted as valid configuration commands by the Unbound daemon upon its next reload or restart cycle. This mechanism bypasses standard access controls because the injection occurs within a module restricted only to users with specific DNS management rights, rather than requiring full administrative privileges. The ability to inject local-data and local-zone directives is particularly dangerous as it allows for precise control over how domain name resolutions are handled locally by the firewall's DNS resolver.
The operational impact of this vulnerability is severe, primarily centering on DNS hijacking and traffic interception capabilities. An attacker who successfully exploits this flaw can configure Unbound to serve fabricated DNS responses to clients on the local area network. For instance, by using a local-zone directive set to type static or refuse, an attacker can prevent resolution for specific domains, effectively causing denial of service for those services. More insidiously, through forward-zone directives, traffic intended for legitimate external servers can be redirected to malicious infrastructure controlled by the attacker. This facilitates man-in-the-middle attacks where sensitive data such as credentials, session tokens, or proprietary information transmitted over DNS or subsequent HTTP/HTTPS connections (if SSL stripping is also employed) can be intercepted and exfiltrated. Furthermore, local-data injections allow for IP address spoofing in responses, potentially leading to cache poisoning scenarios that compromise the integrity of DNS lookups for all users relying on this pfSense device as their primary resolver.
This vulnerability aligns with CWE-74 Improper Neutralization of Special Elements used in an OS Command and CWE-93 Improper Neutralization of CRLF Sequences, reflecting a failure to properly sanitize input before its inclusion in system configuration files. In the context of the MITRE ATT&CK framework, this exploit maps to T1071 Application Layer Protocol for command and control or data exfiltration via DNS manipulation, as well as T1564 Hidden Files and Directories if used to obscure malicious configurations. The attack vector is classified as local with low complexity but requires authentication, highlighting the risk of privilege escalation through lateral movement within network management interfaces where users may have more permissions than necessary for their role.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to apply the vendor-provided patch or upgrade pfSense CE to version 2.9.1 or later, which addresses the input validation flaws in services_unbound_acls.php. In environments where immediate patching is not feasible, administrators should restrict access to the DNS Resolver Access Lists feature to only those users who absolutely require it, adhering to the principle of least privilege. Additionally, implementing strict web application firewalls (WAF) rules that detect and block CRLF injection patterns in HTTP POST requests can provide a layer of defense-in-depth. Regular auditing of Unbound configuration files for unexpected directives is also recommended to detect any potential exploitation attempts post-patch deployment or during the window before updates are applied.