CVE-2026-111214: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has the QinQ edit privilege can exploit it. The attack does not require user interaction or a separate network-side condition beyond access to the affected pfSense CE interface.
What does an attacker need to do to execute commands?
The attacker must save a crafted parent interface value in the QinQ configuration and then edit that QinQ entry. The stored value is later interpolated into ifconfig shell commands, allowing command execution as root.
What is the impact of successful exploitation?
Successful exploitation allows commands to run as root on the pfSense CE system. This can compromise confidentiality, integrity, and availability.