CVE-2026-111215: Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaceswirelessedit.php or interfacesassign.php, which interfacewirelessclone() interpolates unescaped into an ifconfig shell command.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with limited Wireless Edit or Interface Assignments privileges can exploit it. The attacker does not need full administrative privileges, but does need access to one of the affected configuration workflows.
What input and endpoints are involved?
Exploitation requires supplying a crafted wireless parent interface name, such as an interface value containing a command separator and command. The vulnerable paths are interfaces_wireless_edit.php and interfaces_assign.php, which pass the value to interface_wireless_clone().
What level of access can successful exploitation provide?
Successful exploitation allows the authenticated attacker to execute operating-system commands as root. This can affect confidentiality, integrity, and availability of the pfSense system.
How can I determine whether my system is affected?
Netgate pfSense CE through version 2.9.0 is identified as affected. Review whether users have Wireless Edit or Interface Assignments privileges and whether the affected interface configuration pages are accessible to them.