pfsense-l2tp-radius-mpd

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-l2tp-radius-mpd pfsense-l2tp-radius-mpd Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org vpn.inc interpolates "$radiussecret" quoted but unescaped. PPP client uses getmpdstr; servers...

CVE-2026-111221

Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability...

CVE-2026-111221

Netgate pfSense CE versions through 2.9.0 are vulnerable to a configuration injection flaw. Authenticated WebGUI users with L2TP or PPPoE Server edit privileges can inject mpd5 commands by submitting an unescaped RADIUS shared secret containing quotes and newlines. By targeting vpn_l2tp.php or se...

EUVD-2026-102333

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-111221

...

CVE-2026-111221

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-111221

...

pfsense-l2tp-radius-mpd

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-111221: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...