CVE-2026-111219: Improper Neutralization of CRLF Sequences ('CRLF Injection') in Netgate pfSense CE
Description
Netgate pfSense CE versions up to 2.9.0 contain a CRLF injection vulnerability in the services_pppoe_edit.php component. This flaw allows privileged users with PPPoE Server Edit rights to inject malicious entries into the mpd.secret file via unvalidated username POST fields. By injecting a line starting with '!', attackers can cause the mpd5 daemon to execute commands as root upon PPPoE client authentication. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.5.
CVSS v4.0
Score 7.5high
Affected software
Netgate
pfSense CE
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111219 is a CRLF injection vulnerability in Netgate pfSense CE through version 2.9.0. The issue exists in the services_pppoe_edit.php script, where privileged users can submit specially crafted username POST fields that are not properly validated. This allows injection of mpd.secret entries, specifically lines beginning with '!', which causes the mpd5 daemon to execute arbitrary commands as root when a PPPoE client authenticates. The vulnerability requires the attacker to have PPPoE Server Edit privileges and does not involve user interaction. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with PPPoE Server Edit privileges can inject commands that run as root on the pfSense CE system during PPPoE client authentication. This could lead to full system compromise, unauthorized command execution, and potential disruption of network services. The vulnerability affects system integrity and availability with high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict PPPoE Server Edit privileges to trusted administrators only. Monitor vendor channels for updates and apply official patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T18:21:19.617Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad123bc2cdf04f65652b73d
Added to database: 10/15/2026, 19:04:28 UTC
Last enriched: 10/15/2026, 19:19:27 UTC
Last updated: 10/15/2026, 19:19:27 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.