CVE-2026-111229

Received Received - Intake

Command Injection in pfSense CE

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111229

EUVD

EUVD-2026-102341

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in pfSense CE 2.7.0 through 2.9.0 affecting the Captive Portal HA sync feature. Users with only the Captive Portal HA privilege can execute commands as root by manipulating the backwardsyncip parameter to point to a malicious XMLRPC server. The server returns user data with shell metacharacters in IP or MAC fields, which are passed unescaped to a pfctl shell command via captiveportal_load_pfctl.

Detection Guidance

Check pfSense versions 2.7.0 through 2.9.0 for the Captive Portal HA sync feature. Inspect services_captiveportal_hasync.php for unauthorized XMLRPC server configurations or malicious ip/mac fields in user data. Monitor pfctl command execution logs for unexpected root-level shell commands.

Impact Analysis

An attacker could gain root access to the pfSense system, allowing them to take full control of the device. This could lead to network compromise, data theft, or disruption of network services. The attack requires only the Captive Portal HA privilege, making it accessible to users with limited permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive network traffic or data, violating confidentiality requirements in GDPR and HIPAA. A successful exploit may result in data breaches, requiring breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade pfSense to a patched version beyond 2.9.0. Disable Captive Portal HA sync if unused. Restrict WebGUI access to trusted users only. Apply input validation patches for ip/mac fields in services_captiveportal_hasync.php.

Hi! I’m here to help you understand CVE-2026-111229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70