CVE-2026-111229: Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell metacharacters in ip or mac fields, which captiveportalloadpfctl passes unescaped to a pfctl shell command.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has the Captive Portal HA privilege can exploit it. The provided data does not indicate that lower-privileged users or unauthenticated network clients can do so.
What does an attacker need to control to trigger command execution?
The attacker must configure backwardsyncip to point to a malicious XMLRPC server. That server must return connected_users data containing shell metacharacters in the ip or mac fields.
What level of access can successful exploitation provide?
Successful exploitation allows command execution as root on the pfSense CE system.
Which pfSense CE versions are affected?
The affected range is pfSense CE 2.7.0 through 2.9.0.