CVE-2026-111218

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated attackers can run arbitrary commands as root on the firewall. They must have network access to the web interface and high privileges to configure Traffic Shaper Limiters.

Root cause

The delete_queue() function in shaper.inc passes an unquoted, user-tampered limiter number directly to dnctl via /bin/sh without sanitization.

Affected systems

Netgate pfSense CE 2.7.0 through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed version beyond 2.9.0 once released by Netgate. As an interim workaround, revoke Traffic Shaper Limiters management privileges from untrusted administrative users or restrict web GUI access to trusted management subnets.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111218