CVE-2026-111223

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-74

Impact

Authenticated administrators with IPsec Mobile privileges can achieve arbitrary root command execution. They need existing network access and high-privilege credentials on the pfSense web interface.

Root cause

The IPsec Mobile login_banner field lacks proper sanitization and quoting when written to strongswan.conf, allowing attackers to inject closing braces and register arbitrary charon.start-scripts.

Affected systems

Netgate pfSense CE 2.7.0 through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed pfSense release beyond 2.9.0 once available or apply vendor commit 27a52d0807. As an interim workaround, restrict or revoke IPsec Mobile configuration access from untrusted administrators and ensure the login_banner setting contains no unescaped brace characters.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111223