CVE-2026-111223: Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the loginbanner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pfSense CE user who has IPsec Mobile privileges can exploit it. The described attack does not require user interaction and can be performed over the network.
What must an attacker do for their command to run?
The attacker must set the IPsec Mobile login_banner field to a single-line value containing a closing brace character. This escapes the unquoted strongswan.conf attribute value and injects charon.start-scripts entries, which execute as root when charon restarts.
What is the impact of successful exploitation?
Successful exploitation results in command execution as root on the pfSense CE system. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.
Which versions are identified as affected?
The affected range is Netgate pfSense CE 2.7.0 through 2.9.0.