CVE-2026-111224

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes an...

CVE-2026-111224

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection vulnerability within the openvpn.connect_async.sh script. Authenticated VPN users, specifically those authenticated via RADIUS or LDAP , can execute arbitrary commands with root privileges by providing crafted usern...