CVE-2026-111231: Incorrect Authorization in Netgate pfSense CE
Description
Netgate pfSense CE versions up to 2.9.0 have an authorization bypass vulnerability that allows read-only WebGUI users with certain page privileges to replace the configuration file (config.xml). This occurs because the functions config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Exploiting this flaw can lead to root-level code execution after a system reload or reboot.
CVSS v4.0
Score 8.6high
Affected software
Netgate
pfSense CE
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111231 is an authorization bypass vulnerability in Netgate pfSense CE through version 2.9.0. The vulnerability arises because config_restore() and config_install() functions do not respect the 'User - Config: Deny Config Write' privilege, allowing read-only WebGUI users who have access to specific pages (services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php) to replace the config.xml file. By installing a malicious config.xml, an attacker can achieve root-level code execution after the device reloads or reboots.
Potential Impact
An attacker with page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can bypass intended authorization restrictions to replace the configuration file. This can lead to root-level code execution on the affected system after reload or reboot, potentially compromising the entire device and network security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict WebGUI access to trusted users only and monitor for unauthorized configuration changes. Avoid granting page privileges to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T18:21:23.999Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad123c12cdf04f65652b7ae
Added to database: 10/15/2026, 19:04:33 UTC
Last enriched: 10/15/2026, 19:18:22 UTC
Last updated: 10/15/2026, 19:19:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.