pfsense-config-readonly-restore

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-config-readonly-restore pfsense-config-readonly-restore Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org writeconfig honors user-config-readonly. configinstall and...

CVE-2026-111231

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111231

Netgate pfSense CE versions through 2.9.0 are vulnerable to an authorization bypass due to how the config_restore() and config_install() functions operate. These functions fail to respect the 'User - Config: Deny Config Write' privilege, allowing read-only WebGUI users to replace the config.xml f...