Vulnerability in Netgate pfSense CE

[ Description ]Official description

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund15 Oct 2026WID-SEC-2026-3983

  Netgate pfSense: Multiple vulnerabilities Translated from German

  CVE-2026-111230CVE-2026-111225CVE-2026-111220+17 more CVEs

[ References ]References

• abraxaslabs.tech/research/pfsense-ce-leftoversIssue Tracking
• github.com/abraxas/pfsense-dyndns-fileThird Party Advisory
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dy…Product
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/dy…Product
• github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/…Product
• www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-local-file-read-via-dynam…Third Party Advisory