Threat database

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.

Netgate pfSense CE versions 2.3.0 through 2.9.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with Firewall: Rules or NAT: Port Forward privileges can inject malicious scripts via the separator color field. These scripts are rendered unencoded in class attributes by the display_separator() function, allowing execution in administrators' browsers. This can lead to unauthorized WebGUI actions performed with administrator privileges. The vulnerability has a CVSS 4.8 (medium) score and requires user interaction with elevated privileges.

Netgate pfSense CE versions up to 2.9.0 have an authorization bypass vulnerability that allows read-only WebGUI users with certain page privileges to replace the configuration file (config.xml). This occurs because the functions config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Exploiting this flaw can lead to root-level code execution after a system reload or reboot.

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

pfSense CE versions 2.7.0 through 2.9.0 contain a command injection vulnerability in the captive portal high availability feature. This flaw allows users with the Captive Portal HA privilege to execute arbitrary commands as root by exploiting unescaped input passed to a shell command.

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

Netgate pfSense CE up to version 2.9.0 has a CRLF injection vulnerability in the DNS Resolver Access Lists feature. Authenticated users with the appropriate privilege can inject configuration directives into Unbound's access_lists.conf file by embedding CR/LF characters in specific fields. This allows manipulation of DNS responses served to LAN clients.

pfSense CE versions 2.4.5 through 2.9.0 have an OS command injection vulnerability in the WebGUI Login Protection settings. Authenticated users with Advanced Admin Access can inject commands as root by submitting specially crafted values containing newlines or command substitution syntax. This vulnerability allows execution of arbitrary commands with root privileges.

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

pfSense CE versions up to and including 2.9.0 contain an OS command injection vulnerability in the OpenVPN connect script. Authenticated VPN users via RADIUS or LDAP can exploit this by using crafted usernames with special shell characters to execute commands as root. This vulnerability allows privilege escalation through improper input neutralization in the openvpn.connect_async.sh script.

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

CVE-2026-111222 is a high-severity vulnerability in Netgate pfSense CE up to version 2.9.0. It allows authenticated users with General Setup privileges to inject php.ini directives by submitting an unvalidated timezone value. This injection can lead to execution of PHP code as root after system boot or php-fpm restart.

CVE-2026-111221 is a configuration injection vulnerability in Netgate pfSense CE up to version 2.9.0. Authenticated users with L2TP or PPPoE Server edit privileges can inject commands by submitting an unescaped RADIUS shared secret containing special characters. This allows execution of arbitrary commands as root when a session starts, due to improper neutralization of CRLF sequences.

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

Netgate pfSense CE versions up to 2.9.0 have a CRLF injection vulnerability in the services_pppoe_edit.php component. This flaw allows privileged users with PPPoE Server Edit rights to inject malicious entries into the mpd.secret file via unvalidated username POST fields. By injecting a line starting with '!', attackers can cause the mpd5 daemon to execute commands as root when a PPPoE client authenticates.

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

Netgate pfSense CE up to version 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute arbitrary commands as root. The issue arises from improper validation of the CARP VHID value, which can include shell metacharacters. This vulnerability is triggered during interface IP alias configuration or when rendering CARP status, leading to command execution with elevated privileges.

Netgate pfSense CE up to version 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute arbitrary commands as root. This occurs via injection of shell metacharacters into an IPv6 link-local zone index when setting a gateway Monitor IP. The vulnerability arises because the zone value is not properly validated or escaped before being passed to the dpinger shell command.

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

Netgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection vulnerability. Authenticated users with QinQ edit privileges can exploit this flaw by saving a crafted parent interface name that is not properly validated. This input is then interpolated into ifconfig shell commands, allowing execution of arbitrary commands with root privileges.