Vulnerability in Netgate pfSense CE

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)
• EPSS: 10% chance of exploitation in the next 30 days (higher than 96% of CVEs)

[ Description ]Official description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund15 Oct 2026WID-SEC-2026-3983

  Netgate pfSense: Multiple vulnerabilities Translated from German

  CVE-2026-111230CVE-2026-111225CVE-2026-111220+17 more CVEs

[ References ]References

• abraxaslabs.tech/research/pfsense-ce-leftoversIssue Tracking
• abraxaslabs.tech/research/pfsense-qinq-parent-ifExploitIssue Tracking
• github.com/abraxas/pfsense-qinq-parent-ifExploitMitigation
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/in…Product
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/…Product
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/…Product
• www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injectio…Third Party Advisory