CVE-2026-110908: OS Command Injection
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.21 and source revision 2.1.21 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense WebGUI user who has only the page-status-frr privilege can exploit it. Network access alone is not sufficient; the attacker must be able to log in and access the FRR status page.
What level of access can exploitation provide?
An attacker can cause attacker-selected commands to run as root through the affected FRR status filter. This can impact confidentiality, integrity, and availability of the pfSense system.
Which installations should be updated?
Installations using the pfSense-pkg-frr package version 2.0.2_1 or source revision 2.1.2_1 are affected. Updated FRR packages are available for pfSense Plus 26.07 and 26.03.1, and pfSense CE 2.9.0 and 2.8.1.
What can be done if the FRR package cannot be updated immediately?
Restrict WebGUI access and remove the page-status-frr privilege from accounts that do not strictly require it. Because exploitation requires an authenticated user with that privilege, limiting that permission reduces exposure.