CVE-2026-111223

Received Received - Intake

Authenticated Command Injection in Netgate pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111223

EUVD

EUVD-2026-102335

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0. Authenticated users with IPsec Mobile privileges can exploit improper input handling in the login_banner field to execute arbitrary commands as root. By submitting a banner containing a closing brace '}', attackers can escape the unquoted strongswan.conf attribute and inject malicious charon.start-scripts entries that execute when the IPsec service restarts.

Detection Guidance

Check pfSense IPsec Mobile login banner settings for unusual entries. Inspect strongswan.conf for unquoted or malformed login_banner values containing special characters like '}'. Monitor for unexpected charon.start-scripts entries or service restarts.

Impact Analysis

If exploited, this vulnerability allows attackers with valid IPsec Mobile credentials to gain full root access to the pfSense system. This could lead to complete system compromise, unauthorized data access, network traffic interception, or installation of persistent malware. The impact requires only valid user credentials and access to the vulnerable interface.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive systems and data. Full system compromise could result in data breaches, loss of audit trails, and failure to maintain data integrity and confidentiality requirements mandated by these standards.

Mitigation Strategies

Upgrade pfSense to a patched version if available. Remove IPsec Mobile login banner privileges for non-admin users. Disable IPsec Mobile service if not needed. Monitor for unauthorized configuration changes or service restarts.

Hi! I’m here to help you understand CVE-2026-111223. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70