CVE-2026-111225

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Netgate pfSense VPN Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111225

EUVD

EUVD-2026-102337

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Netgate pfSense CE versions 2.5.0 through 2.9.0. It exists in the openvpn.learn-address.sh script used for DNS management. Authenticated VPN clients can exploit it by embedding shell metacharacters in the certificate common name or username. When DNS Resolver client registration is enabled, the script interpolates unquoted user input into su -c commands, allowing command execution as the unbound user.

Detection Guidance

Check if DNS Resolver client registration is enabled in pfSense under Services > DNS Resolver > General Settings. Inspect the openvpn.learn-address.sh script for improper handling of the common name (CN) field. Look for unquoted user input in su -c commands within the script.

Impact Analysis

An attacker with valid OpenVPN access could execute arbitrary commands as the unbound user. This may lead to unauthorized system access, data manipulation, or denial of service via DNS cache poisoning. The impact depends on the privileges of the unbound user and the pfSense configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized command execution as the unbound user. If exploited, it may lead to unauthorized access to sensitive data, data integrity breaches, or denial of service, which are critical concerns under these regulations.

Mitigation Strategies

Disable DNS Resolver client registration in pfSense if enabled. Update pfSense to the latest version where this issue is patched. Restrict VPN client access to trusted users only. Monitor for unusual DNS activity or unauthorized commands executed by the unbound user.

Hi! I’m here to help you understand CVE-2026-111225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70