CVE-2026-110908: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Netgate pfSense-pkg-frr

The vulnerability exists in the FRR status filter of Netgate pfSense-pkg-frr 2.0.2_1 and source revision 2.1.2_1. An authenticated WebGUI user with page-status-frr privilege can inject OS commands by supplying a filter value that escapes the intended single-quoted sed expression. This occurs because escapeshellarg() output is concatenated into the sed expression, and shell command substitution is evaluated through a popen() pipeline, resulting in arbitrary command execution with root privileges. Updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1 have been released to fix this vulnerability.

Successful exploitation allows an authenticated user with limited privileges (page-status-frr) to execute arbitrary commands as root on the affected system. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.8, indicating a high severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

Updated FRR packages for pfSense Plus versions 26.07 and 26.03.1, and pfSense CE versions 2.9.0 and 2.8.1 are available and should be applied to remediate this vulnerability. Users should upgrade to these fixed versions to eliminate the risk. No alternative mitigations or workarounds are provided in the advisory.