CVE-2026-111219

Undergoing Analysis Undergoing Analysis - In Progress

Newline Injection in Netgate pfSense CE PPPoE Server

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111219

EUVD

EUVD-2026-102331

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-111219 is a command injection vulnerability in Netgate pfSense CE through version 2.9.0. It allows authenticated users with PPPoE Server Edit privileges to inject malicious commands via the username field in services_pppoe_edit.php. The flaw occurs because newline characters are not properly sanitized, enabling attackers to manipulate the mpd.secret file. Since the mpd5 daemon runs as root, this leads to arbitrary command execution with elevated privileges.

Detection Guidance

Check pfSense logs for unusual PPPoE server username entries containing newline characters or commands. Inspect the mpd.secret file for entries starting with '!' followed by commands. Review WebGUI access logs for users editing PPPoE server settings.

Impact Analysis

An attacker with PPPoE Server Edit access could execute arbitrary commands as root on the pfSense system. This could allow full system compromise, unauthorized access to sensitive data, or disruption of network services. The impact depends on the attacker's goals and the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Organizations using affected pfSense versions may face regulatory penalties or reputational damage if exploited.

Mitigation Strategies

Upgrade pfSense to a patched version if available. Disable PPPoE server functionality if unused. Restrict WebGUI access to trusted users only. Monitor for unauthorized PPPoE server edits or suspicious username entries.

Hi! I’m here to help you understand CVE-2026-111219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70