CVE-2026-111215

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111215

EUVD

EUVD-2026-102327

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-111215 is an OS command injection flaw in Netgate pfSense CE through version 2.9.0. It allows authenticated users with limited privileges to execute arbitrary commands as root by injecting malicious input into the wireless parent interface name field. The vulnerability occurs because the interface_wireless_clone() function does not properly sanitize user input before passing it to shell commands like ifconfig.

Detection Guidance

To detect this vulnerability, check pfSense versions up to 2.9.0 for the affected files interfaces_wireless_edit.php and interfaces_assign.php. Look for unescaped user input in the wireless parent interface name field or interface assignment parameters. Monitor for unusual commands executed via ifconfig or unexpected network changes.

Impact Analysis

This vulnerability allows attackers with authenticated access to execute root-level commands on the pfSense system. They could read sensitive files like config.xml, modify network configurations, install malware, or disrupt services. Exploitation requires access to the WebGUI with Wireless Edit or Interface Assignments privileges.

Compliance Impact

This vulnerability allows authenticated attackers to execute arbitrary commands as root, potentially leading to unauthorized access to sensitive data. For GDPR, this could result in unauthorized data access or processing, violating principles of lawfulness and integrity. For HIPAA, it may enable unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Mitigation Strategies

Immediately update pfSense to the latest patched version. If no patch is available, restrict access to the WebGUI to trusted users only. Disable wireless interface editing and interface assignment privileges for non-admin users. Monitor logs for suspicious activity related to interface modifications or command execution.

Hi! I’m here to help you understand CVE-2026-111215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70