CVE-2026-111229

7.2High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated users with Captive Portal HA privileges can execute arbitrary shell commands as root. The attacker needs an account with this specific privilege and network access to point the sync target at a malicious XMLRPC server.

Root cause

The captiveportal_load_pfctl function executes pfctl shell commands using unsanitized IP and MAC values retrieved from a remote XMLRPC server during HA sync.

Affected systems

pfSense CE 2.7.0 through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed pfSense release beyond 2.9.0 when available; in the interim, revoke the Captive Portal HA privilege from non-admin accounts and block untrusted XMLRPC backwardsyncip targets.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111229