CVE-2026-111217
Pfsense: OS command injection
- Risk score
- 67/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 6.7%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() if…
- Affected
- Pfsense
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Pfsense: Amber, patch this week. Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell com…
The flaws
- CVE-2026-111217: OS command injection (CVSS 7.2 · EPSS 7%)
- CVE-2026-111214: OS command injection (CVSS 7.2 · EPSS 10%)
- CVE-2026-111225: OS command injection (CVSS 8.8 · EPSS 6%)
- CVE-2026-111218: OS command injection (CVSS 7.2 · EPSS 8%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Pfsense
Where it stands
- Public proof of concept
Connects to
- Same weakness: OS command injection (CWE-78). 305 other warnings in 30 days
- Same product: Earlier Pfsense warnings. 12 in the last 90 days
Why it is Amber
- CVSS 7.2 high
- Exploitation likely: EPSS 6.7% (top 6%)
- Public exploit or proof of concept referenced
References
- https://abraxaslabs.tech/research/pfsense-carp-vhid
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-carp-vhid
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid
Original description
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
Last activity 15 Oct 2026. Patch Forecast updates every hour.