CVE-2026-111231

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Netgate pfSense CE Leading to RCE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111231

EUVD

EUVD-2026-102343

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Netgate pfSense CE through 2.9.0 allows read-only WebGUI users to bypass the 'Deny Config Write' privilege and replace the config.xml file. Attackers with access to specific pages like services_acb.php or uploadconfig.php can exploit this to install a malicious config.xml, leading to root-level code execution after a system reload or reboot.

Detection Guidance

Check for unauthorized access to pages like services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. Review logs for unexpected config.xml modifications or restores. Inspect system logs for unusual reboot events or config changes after such actions.

Impact Analysis

An attacker could gain full control of the pfSense firewall by replacing config.xml, allowing them to execute arbitrary code with root privileges. This could lead to unauthorized network access, data breaches, or disruption of firewall services. Systems may require a reboot to execute the malicious config.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A compromised firewall may expose protected health information or personal data, resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade pfSense CE to a version beyond 2.9.0 where the fix is applied. Disable access to the vulnerable pages for read-only users. Monitor config.xml changes and system reboots. Apply the latest security patches immediately.

Hi! I’m here to help you understand CVE-2026-111231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70