Vulnerability in Netgate pfSense CE

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund15 Oct 2026WID-SEC-2026-3983

  Netgate pfSense: Multiple vulnerabilities Translated from German

  CVE-2026-111230CVE-2026-111225CVE-2026-111220+17 more CVEs

[ References ]References

• abraxaslabs.tech/research/pfsense-ce-leftovers
• github.com/abraxas/pfsense-ovpn-connect-eval
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/…
• www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-…