CVE-2026-111214

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated attackers with QinQ edit privileges can execute arbitrary shell commands as root. They need network access to the pfSense web interface and a valid account with QinQ configuration rights.

Root cause

The web interface saves an unvalidated parent interface name ('if') into the configuration, which is later interpolated directly into shell-executed ifconfig commands.

Affected systems

Netgate pfSense CE 2.7.0 through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade beyond pfSense CE 2.9.0 once a fixed release is available. If patching must wait, revoke the 'Interfaces: QinQ: Edit' privilege from all non-administrative users and restrict web GUI access.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111214