CVE-2026-111221: Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
Published Oct 15, 2026
·Updated
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability.
Affected Software
2 affected components
Netgate pfSense CE<=2.9.0
pfSense pfSense<=2.9.0
Event History
Oct 15, 2026
CVE Published
via MITRE·06:46 PM
Rejected
via MITRE·06:46 PM
Data Sourced
via NVD·07:17 PM
Description
Nov 6, 2026
Rejected
via MITRE·06:23 PM
Frequently Asked Questions
1
Who can exploit this vulnerability?
An authenticated pfSense WebGUI user needs edit privileges for either the L2TP server or PPPoE server configuration. Network access alone is not sufficient.
2
What input is required to trigger command execution?
The attacker must submit a RADIUS shared secret containing a quote and newline through vpn_l2tp.php or services_pppoe_edit.php. This injects mpd5 configuration directives, including an up-script that runs as root when a session starts.
3
When does the injected command run?
The injected up-script executes as root when an L2TP or PPPoE session starts. The provided information does not establish that execution occurs immediately when the malicious configuration is saved.