CVE-2026-111217
highNetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute comm…
Vendor / product: Pfsense — pfsense
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
CVSS
7.2
7.2 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-10-15 19:17
Modified: 2026-10-21 01:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:03 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
pfsense / pfsense ≤2.9.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://abraxaslabs.tech/research/pfsense-carp-vhid
References
- https://abraxaslabs.tech/research/pfsense-carp-vhid disclosure@vulncheck.com
- https://abraxaslabs.tech/research/pfsense-ce-leftovers disclosure@vulncheck.com
- https://github.com/abraxas/pfsense-carp-vhid disclosure@vulncheck.com
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/i... disclosure@vulncheck.com
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/i... disclosure@vulncheck.com
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/l... disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:03 UTC · record ↗