CVE-2026-111221

Awaiting Analysis Awaiting Analysis - Queue

Authenticated Configuration Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111221

EUVD

EUVD-2026-102333

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-111221 is a command injection vulnerability in Netgate pfSense CE through version 2.9.0. It allows authenticated WebGUI users with L2TP or PPPoE Server edit privileges to inject malicious commands via the RADIUS shared secret field by submitting a secret containing a quote and newline character. The injected commands are executed as root when a session starts.

Detection Guidance

To detect this vulnerability, check pfSense logs for unusual RADIUS secret configurations or POST requests to vpn_l2tp.php or services_pppoe_edit.php with malformed secrets. Inspect mpd.conf for injected commands or unexpected up-scripts. Use pfSense's built-in packet capture or tcpdump to monitor traffic to these endpoints for suspicious activity.

Impact Analysis

An attacker with access to the WebGUI can exploit this to execute arbitrary commands as root on the pfSense system. This could lead to full system compromise, unauthorized access, data theft, or disruption of network services. The attacker needs authenticated access but no additional privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. A successful exploit may result in data breaches, non-compliance with data protection regulations, and potential legal penalties due to compromised systems handling protected health or personal information.

Mitigation Strategies

Immediately update pfSense to the latest patched version. If an update is unavailable, disable L2TP/PPPoE server configurations or restrict WebGUI access to trusted users. Review and sanitize RADIUS shared secrets in L2TP/PPPoE settings to remove any quotes or newline characters. Monitor for signs of exploitation in logs.

Hi! I’m here to help you understand CVE-2026-111221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70