CVE-2026-111221: Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpnl2tp.php or servicespppoeedit.php, appending an up-script that executes as root when a session starts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated pfSense WebGUI user needs edit privileges for either the L2TP server or PPPoE server configuration. Network access alone is not sufficient.
What input is required to trigger command execution?
The attacker must submit a RADIUS shared secret containing a quote and newline through vpn_l2tp.php or services_pppoe_edit.php. This injects mpd5 configuration directives, including an up-script that runs as root when a session starts.
When does the injected command run?
The injected up-script executes as root when an L2TP or PPPoE session starts. The provided information does not establish that execution occurs immediately when the malicious configuration is saved.