CVE-2026-111224

Awaiting Analysis Awaiting Analysis - Queue

pfSense CE OS Command Injection via OpenVPN Script

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111224

EUVD

EUVD-2026-102336

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-111224 is an OS command injection flaw in pfSense CE through version 2.9.0. It exists in the OpenVPN openvpn.connect_async.sh script where authenticated VPN users can execute root-level commands via crafted usernames. Attackers authenticated through RADIUS or LDAP can inject shell metacharacters and single quotes into usernames to break out of the eval'd pfctl anchor name during OpenVPN connection or disconnection events.

Detection Guidance

Check for unusual OpenVPN connection logs or commands executed by the openvpn.connect_async.sh script. Look for usernames containing single quotes or shell metacharacters in RADIUS or LDAP authentication logs. Inspect pfSense firewall rules for unexpected changes.

Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary commands with root privileges on the pfSense system. If exploited, it could lead to full system compromise, unauthorized access to sensitive data, installation of malware, or disruption of network services. The impact is severe as it bypasses normal access controls and operates at the highest privilege level.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations. It allows unauthorized root access to systems handling sensitive data, potentially leading to data breaches, unauthorized data access, or system modifications. Organizations would likely face regulatory fines, mandatory breach notifications, and reputational damage due to the high-severity nature of this flaw.

Mitigation Strategies

Upgrade pfSense CE to a patched version beyond 2.9.0. Apply input validation to RADIUS and LDAP usernames to block single quotes and shell metacharacters. Disable OpenVPN server_user or server_tls_user client authentication if not required.

Hi! I’m here to help you understand CVE-2026-111224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70