[ CVE-2026-111221 · Published 15 Oct 2026 ]
Vulnerability in Netgate pfSense CE
CVSS 7.2
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3983
Netgate pfSense: Multiple vulnerabilities Translated from German
[ References ]References
- abraxaslabs.tech/research/pfsense-ce-leftoversIssue Tracking
- github.com/abraxas/pfsense-l2tp-radius-mpdThird Party Advisory
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vp…Product
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vp…Product
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/…Product
- www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-rad…Third Party Advisory