CVE-2026-111216

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated users with gateway editing privileges can execute arbitrary shell commands as root. They need network access to the pfSense administrative interface and an account with permission to configure gateways.

Root cause

The start_dpinger() function passes an unvalidated IPv6 link-local zone index from the gateway Monitor IP field directly into a shell command without escaping shell metacharacters.

Affected systems

Netgate pfSense CE through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed pfSense release beyond 2.9.0 when available; in the meantime, restrict gateway configuration permissions to fully trusted administrators and revoke administrative web GUI access from untrusted networks.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111216