CVE-2026-111219: Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated account with the PPPoE Server Edit privilege. The vulnerable username value is submitted through the PPPoE server edit interface.
What additional condition is required for command execution?
The attacker must inject an mpd.secret entry whose secret begins with an exclamation mark. mpd5 then executes the resulting command as root when a PPPoE client authenticates.
Is user interaction required?
No interactive user action is required after the attacker has the necessary privilege. However, a PPPoE client must authenticate to trigger mpd5 command execution.