CVE-2026-111225: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Netgate pfSense CE

CVE-2026-111225 is an OS command injection vulnerability affecting Netgate pfSense CE versions 2.5.0 through 2.9.0. The issue resides in the openvpn.learn-address.sh script, which processes authenticated VPN client information. When DNS Resolver client registration is enabled, the script interpolates the certificate common name or username into su -c command strings without proper quoting or neutralization of shell metacharacters. This allows an authenticated VPN client to execute arbitrary commands with the privileges of the unbound user.

An authenticated VPN client can exploit this vulnerability to execute arbitrary OS commands as the unbound user on the pfSense system. The impact is limited by the privileges of the unbound user, which typically has restricted permissions. The CVSS 4.0 base score is 2.3, indicating a low severity vulnerability with network attack vector, high attack complexity, and requiring privileges and partial user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling DNS Resolver client registration if feasible or restrict VPN client authentication to trusted users only to reduce exposure.