CVE-2026-111226

Netgate pfSense CE versions 2.4.5 through 2.9.0 are vulnerable to an OS command injection vulnerability within the system_advanced_admin.php page. This flaw allows authenticated WebGUI users with Advanced Admin Access privileges to execute commands as root . The vulnerability exists because the a...

EUVD-2026-102337

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes an...

CVE-2026-111224

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection vulnerability within the openvpn.connect_async.sh script. Authenticated VPN users, specifically those authenticated via RADIUS or LDAP , can execute arbitrary commands with root privileges by providing crafted usern...

CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the loginbanner field. Attackers can submit a single-line banner containing '' to escape the unquoted strongswan.con...

CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the loginbanner field. Attackers can submit a single-line banner containing '' to escape the unquoted strongswan.con...

CVE-2026-111223

Netgate pfSense CE 2.7.0 through 2.9.0 is vulnerable to a configuration injection flaw in the IPsec Mobile login banner . Authenticated users with IPsec Mobile privileges can execute commands as root by submitting a single-line banner containing a } character. This allows them to escape the unquo...

CVE-2026-111221

Netgate pfSense CE versions through 2.9.0 are vulnerable to a configuration injection flaw. Authenticated WebGUI users with L2TP or PPPoE Server edit privileges can perform a command injection by submitting an unescaped RADIUS shared secret . By sending a secret containing a quote and newline to ...

CVE-2026-111219

Netgate pfSense CE versions through 2.9.0 are vulnerable to a command injection flaw located in services_pppoe_edit.php. The issue stems from a newline injection vulnerability where the application fails to validate username POST fields . A user with PPPoE Server Edit privileges can inject entrie...

CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

EUVD-2026-102330

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111217

Netgate pfSense CE versions through 2.9.0 are vulnerable to an OS command injection flaw. The vulnerability arises from the storage of an unvalidated CARP VHID , which allows authenticated users with Virtual IP edit privileges to execute commands as root . Attackers can provide a VHID containing ...

CVE-2026-111218

Netgate pfSense CE 2.7.0 through 2.9.0 is vulnerable to an OS command injection vulnerability within the Traffic Shaper Limiters . Authenticated users possessing Traffic Shaper Limiters privileges can execute commands as root by tampering with the limiter number field . The flaw occurs because th...

CVE-2026-111216

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection vulnerability. Authenticated users with gateway edit privileges can execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. The root cause is that the start_dpinger() function ...

CVE-2026-111215

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection flaw. The vulnerability exists because the interface_wireless_clone() function interpolates unescaped input into an ifconfig shell command. Authenticated users with limited Wireless Edit or Interface Assignments pri...

CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...

CVE-2026-111214

Netgate pfSense CE versions 2.7.0 through 2.9.0 are vulnerable to an OS command injection flaw within the interfaces_qinq_edit.php component. The root cause is the storage of an unvalidated parent interface name . An authenticated user with QinQ edit privileges can save a crafted 'if ' value; whe...

EUVD-2026-102327

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...