CVE-2026-111220

Awaiting Analysis Awaiting Analysis - Queue

pfSense CE crontab injection via PPPs edit interface

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111220

EUVD

EUVD-2026-102332

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This is a crontab injection vulnerability in pfSense CE through version 2.9.0. It allows authenticated users with the 'WebCfg - Interfaces: PPPs: Edit' privilege to inject newline characters into the ptpid or reset hour/minute fields. The configure_cron() function writes these unsanitized inputs directly into /etc/crontab, enabling attackers to schedule and execute arbitrary root-level commands.

Detection Guidance

Check for unauthorized cron jobs in /etc/crontab by running 'crontab -l' as root. Inspect PPP configuration files for suspicious entries in ptpid or reset hour/minute fields. Monitor system logs for unexpected command executions or cron-related anomalies.

Impact Analysis

An attacker could gain full root access to the pfSense system, allowing them to execute any command, install malware, steal data, or disrupt network operations. The vulnerability enables persistent code execution through cron jobs, making it hard to detect and remove.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations may face fines, legal action, and reputational damage due to non-compliance resulting from this flaw.

Mitigation Strategies

Apply the latest pfSense CE update immediately. Restrict access to the 'WebCfg - Interfaces: PPPs: Edit' privilege. Review and remove any unauthorized cron jobs. Monitor network traffic for signs of compromise.

Hi! I’m here to help you understand CVE-2026-111220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70