CVE-2026-111226

Awaiting Analysis Awaiting Analysis - Queue

pfSense OS Command Injection via Login Protection Settings

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111226

EUVD

EUVD-2026-102338

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-111226 is an OS command injection flaw in pfSense CE versions 2.4.5 through 2.9.0. It allows authenticated users with Advanced Admin Access to execute arbitrary commands as root via the Login Protection settings. Attackers can inject malicious commands through parameters like sshguard threshold, block time, or detection time by including newlines or $(...) syntax. These values are written unvalidated to sshguard.conf and executed as root when the service restarts.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to sshguard.conf or suspicious command execution logs. Inspect system_advanced_admin.php for unexpected input handling. Review WebGUI access logs for users with Advanced Admin privileges making changes to Login Protection settings.

Impact Analysis

This vulnerability allows attackers with valid credentials and Advanced Admin Access to gain full root-level control over the pfSense system. They can execute arbitrary commands, modify system configurations, install malware, or disrupt services. The impact includes complete system compromise, data theft, unauthorized access to network resources, and potential lateral movement within the network.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations. It allows unauthorized access to sensitive data, potential data breaches, and loss of control over system integrity. Organizations may face fines, legal penalties, and reputational damage due to non-compliance with security requirements for protecting sensitive information.

Mitigation Strategies

Immediately update pfSense to the latest patched version. Disable Advanced Admin privileges for non-essential users. Monitor sshguard.conf for unauthorized changes. Restrict WebGUI access to trusted networks only.

Hi! I’m here to help you understand CVE-2026-111226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70