CVE-2026-111217

EUVD-2026-102329
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
netgatepfsense
𝑥
≤ 2.9.0
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/pfsense-carp-vhid
https://abraxaslabs.tech/research/pfsense-ce-leftovers
https://github.com/abraxas/pfsense-carp-vhid
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200
https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid