CVE-2026-111225

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111225

Netgate pfSense CE versions 2.5.0 through 2.9.0 are vulnerable to an OS command injection in openvpn.learn-address.sh. When DNS Resolver client registration is enabled, authenticated VPN clients can execute commands as the unbound user by embedding shell metacharacters in the certificate common n...

CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

EUVD-2026-102337

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...