CVE-2026-111225

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111225

Netgate pfSense CE versions 2.5.0 through 2.9.0 are vulnerable to an OS command injection vulnerability in the openvpn.learn-address.sh script. The flaw occurs because shell metacharacters embedded in the certificate common name or username are interpolated unquoted into su -c strings. This vulne...

PT-2026-115190

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...