CVE-2026-111229 in pfSense CE
Summary
by MITRE • 10/15/2026
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in pfSense Community Edition versions 2.7.0 through 2.9.0 represents a critical security flaw within the Captive Portal High Availability synchronization mechanism. Specifically, the issue resides in the services_captiveportal_hasync.php script, which is responsible for handling high availability state transfers between redundant firewall nodes. The core technical deficiency is a command injection vulnerability that arises from improper input validation and sanitization of data received during XML-RPC communication. This flaw allows an attacker who possesses only the Captive Portal HA privilege to escalate their access rights significantly by executing arbitrary system commands with root-level privileges on the target device.
The operational mechanism of this exploitation involves manipulating the backwardsyncip parameter, which directs synchronization traffic toward a specific IP address acting as an XML-RPC server. An adversary can configure this setting to point to a malicious server under their control. When the pfSense node initiates a synchronization request, it retrieves data from this external source, specifically expecting structured information regarding connected users. The vulnerability is triggered when the retrieved data includes shell metacharacters within the ip or mac fields of the connected_users array. Instead of being properly escaped or sanitized before processing, these malicious inputs are passed directly to the captiveportal_load_pfctl function.
This function subsequently invokes pfctl, a command-line utility used for configuring packet filter rules on FreeBSD-based systems like pfSense. Because the unescaped shell metacharacters from the attacker-controlled input are embedded within the arguments passed to this system call, they allow for arbitrary command execution. The context of this execution is critical; since the synchronization process runs with elevated privileges, any commands injected via this vector execute as root. This effectively bypasses standard access controls and grants the attacker full administrative control over the firewall infrastructure.
From a classification perspective, this vulnerability aligns closely with CWE-78, which denotes Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The attack path also correlates with MITRE ATT&CK techniques related to privilege escalation and command-line interface abuse, specifically leveraging legitimate system utilities for unauthorized actions. The presence of such a flaw in high availability components is particularly concerning because it targets infrastructure that is often assumed to be robust and isolated from direct external manipulation, yet relies on trust relationships between nodes or configurable synchronization endpoints.
The impact of this vulnerability extends beyond simple remote code execution. An attacker with access to the Captive Portal HA privilege can compromise not only the individual firewall node but potentially disrupt high availability failover mechanisms if they manipulate state data further. This could lead to service outages, unauthorized network monitoring, or use of the compromised device as a pivot point for lateral movement within an internal network. Given that pfSense is widely deployed in enterprise and small-to-medium business environments, the potential blast radius includes significant portions of organizational infrastructure depending on how these firewalls are integrated into the broader security architecture.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply vendor-provided patches that update pfSense CE to a version beyond 2.9.0, where this input validation issue has been resolved by properly escaping or rejecting special characters in synchronization data fields. In environments where patching cannot be immediately implemented, administrators should restrict the Captive Portal HA privilege to only those users who absolutely require it for operational purposes. Additionally, network segmentation policies should ensure that any systems configured as XML-RPC servers for high availability are hardened and isolated from untrusted networks. Monitoring logs for unusual pfctl invocations or unexpected synchronization traffic patterns can also aid in early detection of exploitation attempts before full compromise occurs.