CVE-2026-111226: Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be an authenticated pfSense WebGUI user with the Advanced Admin Access privilege. Network reachability alone is not sufficient.
What input is used to trigger command execution?
The attacker submits Login Protection sshguard threshold, block time, or detection time values containing newline characters or $(...) expressions. These values are written to sshguard.conf without validation and are sourced as root when sshguard is restarted.
What level of access can successful exploitation provide?
Successful exploitation allows commands to run as root on the pfSense system. This can affect confidentiality, integrity, and availability.
Which pfSense CE versions are identified as affected?
The affected range is pfSense CE 2.4.5 through 2.9.0.