Skip to content
OpenAdvisories
Medium WID-SEC-2026-3983 20 CVEs

Netgate pfSense: Mehrere Schwachstellen

Published Oct 15, 2026 · Updated Oct 15, 2026 · de-DE

Vendor: Netgate Product: pfSense

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen und um auf Dateien zuzugreifen.

Product

pfSense ist eine Software-Edge-Firewall mit Router- und VPN-Funktionalität.

Vulnerabilities 20

  • High 8.6
    CVE-2026-111229 Rejected

    This CVE ID has been rejected because it does not describe a security vulnerability.

  • High 8.6
    CVE-2026-111231 Rejected

    This CVE ID has been rejected because it does not describe a security vulnerability.

  • High 7.5
    CVE-2026-111221 Rejected

    This CVE ID has been rejected because it does not describe a security vulnerability.

  • High 7.5
    CVE-2026-111224

    Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

    pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can us…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111214 EPSS 11%

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit …

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111215

    Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments pr…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111216

    Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a …

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111217

    Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metac…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111218

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111220

    Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

    pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Inter…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111223

    Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

    Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111226

    Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

    pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block…

    Netgate pfSense CE
  • Medium 6.6
    CVE-2026-111219

    Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

    Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a lin…

    Netgate pfSense CE
  • Medium 6.6
    CVE-2026-111222

    Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting

    Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_pre…

    Netgate pfSense CE
  • Medium 5.5
    CVE-2026-111227

    Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

    Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF character…

    Netgate pfSense CE
  • Medium 5.5
    CVE-2026-111228

    Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

    Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in th…

    Netgate pfSense CE
  • Medium 5.0
    CVE-2026-111225

    Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

    Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common…

    Netgate pfSense CE
  • Medium 4.9
    CVE-2026-111230

    Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

    Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result…

    Netgate pfSense CE
  • Medium 4.8
    CVE-2026-111232

    Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

    Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted se…

    Netgate pfSense CE
  • Medium 4.7
    CVE-2026-111233

    Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

    Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enable…

    Netgate pfSense CE

Revision history

  1. #1

    Initiale Fassung

References