CVE-2026-111220: Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configurecron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated to the pfSense web interface and hold the 'WebCfg - Interfaces: PPPs: Edit' privilege. No separate user interaction is required.
What access does successful exploitation provide?
Crafted values can cause arbitrary commands to be written into /etc/crontab and executed as root on a schedule. This can compromise confidentiality, integrity, and availability of the firewall.
Which configurations are exposed?
Exposure requires the ability to edit PPP configuration through the web interface, because the vulnerable inputs are the PPP ptpid and periodic reset hour/minute fields. The supplied data does not establish whether every default installation grants this privilege.
How can administrators check for possible exploitation?
Review PPP settings and /etc/crontab for unexpected entries, particularly cron lines or commands associated with PPP periodic reset configuration. Also review changes made by accounts that have the PPP edit privilege.