CVE-2026-111227

Awaiting Analysis Awaiting Analysis - Queue

CR/LF Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111227

EUVD

EUVD-2026-102339

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-111227 is a CRLF injection vulnerability in Netgate pfSense CE through version 2.9.0. It exists in the services_unbound_acls.php page where authenticated users with DNS Resolver: Access Lists privilege can inject CR/LF characters into ACL names or actions. This allows attackers to add malicious Unbound configuration directives like local-data, local-zone, or forward-zone to the access_lists.conf file, potentially controlling DNS responses served to LAN clients.

Detection Guidance

Check pfSense logs for unauthorized modifications to access_lists.conf or Unbound configurations. Inspect ACL names and actions for CR/LF characters in services_unbound_acls.php inputs. Use grep to search for suspicious directives like local-data or local-zone in configuration files.

Impact Analysis

This vulnerability allows authenticated attackers to execute remote commands with root privileges via PHP-FPM, compromise system integrity through file inclusion, and potentially cause denial of service by preventing the DNS resolver from starting. Attackers could manipulate DNS responses to redirect users to malicious sites or intercept sensitive data.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized DNS redirection or manipulation of DNS responses. Attackers could intercept or alter DNS queries to exfiltrate sensitive data or redirect users to malicious sites, violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update pfSense to the latest patched version immediately. Disable the DNS Resolver ACL feature if not required. Restrict WebGUI access to trusted networks only. Monitor for unusual DNS responses or file modifications in Unbound directories.

Hi! I’m here to help you understand CVE-2026-111227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70