CVE-2026-111224

7.5High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated VPN users can execute arbitrary commands as root on the firewall upon connection or disconnection. An attacker needs valid VPN credentials (such as via RADIUS or LDAP) containing shell metacharacters.

Root cause

The openvpn.connect_async.sh script passes unsanitized OpenVPN usernames directly into an eval command while generating pfctl anchor names.

Affected systems

pfSense CE through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version beyond 2.9.0 once released. As an interim mitigation, restrict or sanitize allowed username characters on your RADIUS/LDAP authentication backend to block single quotes and shell metacharacters, or temporarily disable affected OpenVPN services.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111224