CVE-2026-111225: Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated VPN client can exploit it by supplying shell metacharacters in its certificate common name or username. The resulting commands execute as the unbound user.
What configuration is required for exploitation?
DNS Resolver client registration must be enabled. The vulnerable script is invoked in that configuration and interpolates the certificate common name or username into su -c command strings without quoting.
Which deployments should be checked?
Check Netgate pfSense CE installations running versions 2.5.0 through 2.9.0, particularly where VPN clients are allowed to authenticate and DNS Resolver client registration is enabled.