CVE-2026-111216

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111216

EUVD

EUVD-2026-102328

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-111216 is an OS command injection vulnerability in Netgate pfSense CE through version 2.9.0. It allows authenticated users with gateway edit privileges to execute arbitrary commands as root by injecting shell metacharacters into an IPv6 link-local zone index. The flaw occurs in the start_dpinger function, which passes unvalidated user input to a shell command without proper escaping.

Detection Guidance

To detect this vulnerability, check pfSense CE versions up to 2.9.0 for unauthorized gateway monitor IP modifications. Inspect system logs for unusual commands executed by dpinger or mwexec. Look for shell metacharacters in IPv6 zone parameters in gateway settings. Review WebGUI access logs for users editing gateways without authorization.

Impact Analysis

An attacker could gain full system compromise with root privileges. This enables reading sensitive files, executing arbitrary commands, disrupting the dpinger monitoring service, or causing denial of service. The attack requires authenticated access to the WebGUI gateway editing page and the ability to apply changes.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized root access could result in exposure of sensitive data, impacting confidentiality and integrity requirements.

Mitigation Strategies

Immediately update pfSense to the latest patched version. Disable gateway edit privileges for non-admin users. Monitor network traffic for unexpected outbound connections from pfSense. Review and audit all gateway configurations for suspicious entries. Consider disabling IPv6 link-local zone monitoring temporarily until patched.

Hi! I’m here to help you understand CVE-2026-111216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70