CVE-2026-111218
Pfsense: OS command injection
- Risk score
- 67/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 8.0%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete i…
- Affected
- Pfsense
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 7.2 high
- Exploitation likely: EPSS 8.0% (top 5%)
- Public exploit or proof of concept referenced
References
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-limiter-number
- https://github.com/abraxas/pfsense-limiter-number
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-traffic-shaper-limiters
Original description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Last activity 15 Oct 2026. Patch Forecast updates every hour.