CVE-2026-111231 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Netgate pfSense Community Edition versions through 2.9.0 represents a critical authorization bypass within the web-based graphical user interface. This flaw stems from an improper implementation of access control mechanisms, specifically where functions responsible for restoring and installing configuration files fail to enforce existing privilege restrictions. The core technical issue lies in the config_restore() and config_install() methods, which do not adequately check whether the authenticated user possesses the 'User - Config: Deny Config Write' permission before proceeding with file operations. Consequently, users who are explicitly restricted from modifying system configurations can still trigger these functions if they have access to specific administrative pages such as services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. This discrepancy between intended security policy and actual code execution logic allows unauthorized actors to bypass standard role-based access controls designed to protect the integrity of the system configuration file, config.xml.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Management. The attacker leverages their existing page-level privileges to upload or specify an arbitrary XML file that replaces the active system configuration. Because pfSense relies heavily on its central configuration file for all operational parameters, including network interfaces, firewall rules, and user accounts, manipulating this file provides a direct path to escalating privileges. Once the malicious config.xml is installed via one of the vulnerable endpoints, the changes take effect upon the next reload or reboot sequence. This process effectively overwrites critical system settings with values defined by the attacker, thereby neutralizing existing security controls and establishing persistent access mechanisms that persist across service restarts.
The operational impact of this vulnerability is severe, leading directly to root-level code execution on the underlying operating system. By crafting a malicious configuration file, an authenticated user can inject arbitrary commands into startup scripts or modify shell initialization files embedded within the XML structure. Upon rebooting the pfSense appliance, these injected commands execute with root privileges, granting the attacker full control over the host machine. This level of access allows for complete compromise of the network perimeter device, enabling further lateral movement, data exfiltration, and disruption of network services. The ability to gain root access without needing higher-level administrative credentials undermines the fundamental security model of multi-user systems where least privilege principles are expected to be enforced strictly at every functional boundary.
This incident aligns with MITRE ATT&CK techniques related to Defense Evasion and Privilege Escalation, specifically leveraging legitimate system tools for unauthorized purposes. The attack vector involves using authorized administrative interfaces to perform actions that should be restricted by role-based permissions, a pattern often seen in complex web applications where backend logic fails to validate user roles against specific action requirements. To mitigate this risk, administrators must ensure their pfSense installations are updated to versions where the authorization checks have been corrected to properly enforce the 'Deny Config Write' privilege during configuration restoration and installation processes. Additionally, organizations should review access controls for all administrative pages to minimize the attack surface by restricting page-level privileges only to users who absolutely require them, thereby reducing the likelihood of exploitation even if similar vulnerabilities exist in other components. Regular auditing of user permissions and monitoring for unusual configuration changes can also serve as effective detection mechanisms against such abuse.