Vulnerabilities

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to…

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

pfSense / OPNsense

CVSS

7.2

EPSS

0.070 (p94)

Exposure class

Edge / VPN / firewall

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111217 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because…

   CVSS 7.2 CVE-2026-111231
2. 22
   CVE NVD 16d ago

   pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the…

   CVSS 7.2 CVE-2026-111229
3. 15
   CVE NVD 16d ago

   Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users…

   CVSS 5.5 CVE-2026-111228
4. 15
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS…

   CVSS 5.5 CVE-2026-111227
5. 22
   CVE NVD 16d ago

   pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access…

   CVSS 7.2 CVE-2026-111226
6. 15
   CVE NVD 16d ago

   Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN…

   CVSS 5.0 CVE-2026-111225
7. 22
   CVE NVD 16d ago

   pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN…

   CVSS 7.5 CVE-2026-111224
8. 22
   CVE NVD 16d ago

   Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges…

   CVSS 7.2 CVE-2026-111223
9. 15
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject…

   CVSS 6.6 CVE-2026-111222 PHP
10. 15
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by…

    CVSS 6.6 CVE-2026-111221
11. 22
    CVE NVD 16d ago

    pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands…

    CVSS 7.2 CVE-2026-111220
12. 15
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject…

    CVSS 6.6 CVE-2026-111219
13. 22
    CVE NVD 16d ago

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters…

    CVSS 7.2 CVE-2026-111218
14. 22
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to…

    CVSS 7.2 CVE-2026-111216
15. 22
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by…

    CVSS 7.2 CVE-2026-111215
16. 28
    CVE NVD 16d ago

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run…

    CVSS 7.2 EPSS 0.11 CVE-2026-111214