CVE-2026-111216: Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which startdpinger() passes unescaped to the dpinger shell command when monitoring is applied.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated pfSense CE user who has privileges to edit gateways can exploit it. The attack requires access to set a gateway Monitor IP.
What input is used to trigger command execution?
The attacker supplies shell metacharacters in the IPv6 link-local zone index of a gateway Monitor IP. When gateway monitoring is applied, the unvalidated zone value is passed unescaped to the dpinger shell command.
What level of access can successful exploitation provide?
Successful exploitation allows command execution as root. This can affect confidentiality, integrity, and availability of the pfSense system.
Are installations after pfSense CE 2.9.0 confirmed to be affected?
The provided information identifies pfSense CE through version 2.9.0 as affected. It does not establish whether later versions are affected or fixed.