Vulnerabilities

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the…

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

pfSense / OPNsense

CVSS

7.2

EPSS

0.064 (p94)

Exposure class

Edge / VPN / firewall

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111229 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because…

   CVSS 7.2 CVE-2026-111231
2. 15
   CVE NVD 16d ago

   Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users…

   CVSS 5.5 CVE-2026-111228
3. 15
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS…

   CVSS 5.5 CVE-2026-111227
4. 22
   CVE NVD 16d ago

   pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access…

   CVSS 7.2 CVE-2026-111226
5. 15
   CVE NVD 16d ago

   Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN…

   CVSS 5.0 CVE-2026-111225
6. 22
   CVE NVD 16d ago

   pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN…

   CVSS 7.5 CVE-2026-111224
7. 22
   CVE NVD 16d ago

   Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges…

   CVSS 7.2 CVE-2026-111223
8. 15
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject…

   CVSS 6.6 CVE-2026-111222 PHP
9. 15
   CVE NVD 16d ago

   Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by…

   CVSS 6.6 CVE-2026-111221
10. 22
    CVE NVD 16d ago

    pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands…

    CVSS 7.2 CVE-2026-111220
11. 15
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject…

    CVSS 6.6 CVE-2026-111219
12. 22
    CVE NVD 16d ago

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters…

    CVSS 7.2 CVE-2026-111218
13. 22
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to…

    CVSS 7.2 CVE-2026-111217
14. 22
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to…

    CVSS 7.2 CVE-2026-111216
15. 22
    CVE NVD 16d ago

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by…

    CVSS 7.2 CVE-2026-111215
16. 28
    CVE NVD 16d ago

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run…

    CVSS 7.2 EPSS 0.11 CVE-2026-111214