CVE-2026-111228 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within Netgate pfSense Community Edition versions 2.7.1 through 2.9.0 represents a critical configuration injection flaw located in the Unbound DNS Resolver service management interface. Specifically, this issue resides in the services_unbound_advanced.php script, which handles advanced configuration parameters for the resolver. The root cause of this vulnerability is a failure to properly sanitize user-supplied input before it is written directly into the unbound.conf configuration file. This lack of validation allows an authenticated attacker with specific privileges to manipulate system behavior by injecting carriage return and line feed characters into the sock_queue_timeout parameter field.
From a technical perspective, the flaw exploits the way the web interface processes form submissions for advanced DNS settings. When a user submits data via this interface, the application takes the value provided in the sock_queue_timeout input and appends it to the configuration file without stripping or escaping control characters such as CR (carriage return) and LF (line feed). In standard text-based configuration files like unbound.conf, these characters serve as delimiters for new directives. By injecting them, an attacker can effectively break out of the intended parameter value and append arbitrary lines to the end of the file. This technique is a classic example of CRLF injection, which in this context functions similarly to command or code injection within configuration files, allowing the execution of unintended commands by the service running under elevated privileges.
The operational impact of this vulnerability is severe due to the high level of access required and the critical nature of DNS resolution services. An attacker who has obtained credentials with the DNS Resolver: Advanced privilege can override local records and modify forwarding rules for all clients connected through the pfSense device. This capability enables several malicious outcomes, including domain hijacking where legitimate traffic is redirected to malicious servers, man-in-the-middle attacks by intercepting or altering DNS responses, and complete denial of service if critical resolution paths are disrupted. Since Unbound operates with significant system privileges, successfully exploiting this flaw grants the attacker substantial control over network traffic flow and potentially facilitates further lateral movement within the internal network infrastructure.
This vulnerability aligns closely with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves special characters being interpreted differently than intended by the downstream configuration parser. It also maps to ATT&CK technique T1505.003 Server Software Component: DNS Service, which covers vulnerabilities that allow attackers to manipulate or disrupt domain name resolution services. The exploitation requires authentication and specific privileges, placing it within the context of privilege escalation via misconfigured access controls if an attacker can escalate from a lower-privilege account to one with advanced resolver permissions.
Mitigation strategies should focus on immediate patching and strict input validation. Administrators running affected versions must upgrade pfSense CE to version 2.9.1 or later, where the developers have implemented proper sanitization of special characters in configuration inputs. Until patches are applied, network segmentation can limit the impact by restricting access to the management interface from untrusted networks. Additionally, implementing strict role-based access control ensures that only trusted administrators possess DNS Resolver: Advanced privileges, reducing the attack surface for potential exploitation. Regular auditing of configuration files and monitoring for unexpected changes in Unbound settings can also aid in early detection of such injection attempts.