CVE-2026-111220

7.2High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-93

Impact

Authenticated attackers can run arbitrary commands as root via crontab injection. Exploitation requires network access to the web interface and an account with the 'WebCfg - Interfaces: PPPs: Edit' privilege.

Root cause

Unsanitized user inputs containing newlines in interfaces_ppps_edit.php are written directly into /etc/crontab by configure_cron().

Affected systems

pfSense CE through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade beyond pfSense CE 2.9.0 once a fixed release is available. In the meantime, revoke the 'WebCfg - Interfaces: PPPs: Edit' permission from untrusted administrative users or restrict web GUI access.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111220