CVE-2026-111217

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated attackers can run arbitrary commands as root on the firewall. They must have existing access to edit Virtual IP settings in the pfSense management interface.

Root cause

Unsanitized CARP VHID input allows shell metacharacters to pass directly into system ifconfig calls during interface configuration and status rendering.

Affected systems

Netgate pfSense CE through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed release beyond 2.9.0 when provided by Netgate. As an interim mitigation, revoke Virtual IP edit privileges from non-root web GUI accounts and restrict administrative access to trusted management networks.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111217