CVE-2026-111217

Awaiting Analysis Awaiting Analysis - Queue

Authenticated OS Command Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111217

EUVD

EUVD-2026-102329

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-111217 is an OS command injection vulnerability in Netgate pfSense CE through version 2.9.0. It allows authenticated users with Virtual IP edit privileges to execute commands as root by injecting shell metacharacters into the CARP VHID field. The issue occurs because the VHID value is not properly validated or escaped in certain code paths, such as stacked IP Alias application and CARP status checks. Attackers can exploit this to gain full control over the affected system.

Detection Guidance

To detect this vulnerability, check pfSense logs for suspicious CARP VHID values or commands executed via ifconfig or CARP status checks. Inspect firewall_virtual_ip.inc, interfaces.inc, and pfsense-utils.inc for improper VHID handling. Look for non-integer VHID values or shell metacharacters in logs.

Impact Analysis

This vulnerability allows attackers with authenticated access to execute arbitrary commands with root privileges. This could lead to complete system compromise, unauthorized access to sensitive data, disruption of network services, or manipulation of firewall configurations. Attackers could install malware, steal credentials, or pivot to other systems in the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications to protected health information, or failure to maintain secure network configurations, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Immediately update pfSense to the latest patched version. Ensure VHID values are validated to be integers between 1-255. Apply escapeshellarg consistently across all code paths handling VHID. Restrict authenticated users with VIP edit privileges to only trusted personnel.

Hi! I’m here to help you understand CVE-2026-111217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70