CVE-2026-111214

Undergoing Analysis Undergoing Analysis - In Progress

Authenticated OS Command Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111214

EUVD

EUVD-2026-102326

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0. Authenticated users with QinQ edit privileges can inject malicious commands by storing an unvalidated parent interface name. When the QinQ entry is edited, the interface name is interpolated into ifconfig shell commands without proper escaping, allowing command execution as root.

Detection Guidance

To detect this vulnerability, check if your pfSense CE version is between 2.7.0 and 2.9.0. Verify if you have users with QinQ edit privileges. Inspect the interfaces_qinq_edit.php file for improper input validation in parent interface names. Look for unescaped ifconfig command executions in logs.

Impact Analysis

An attacker with QinQ edit privileges could execute arbitrary commands as root, leading to full system compromise. This could allow filesystem access, data exfiltration, disruption of network services, or pivoting to compromise other systems in the environment.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Organizations using affected pfSense versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update pfSense CE to a patched version beyond 2.9.0. Remove QinQ edit privileges from non-admin users until patched. Monitor network traffic for unusual commands or root-level shell activity. Disable QinQ interface editing if not required.

Hi! I’m here to help you understand CVE-2026-111214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70