CVE-2026-111231: Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore() and configinstall() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php, uploadconfig.php, diagconfbak.php, or diagbackup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Read-only WebGUI users are exposed if they also have page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. The bypass applies because config_restore() and config_install() do not enforce the User - Config: Deny Config Write privilege.
What does an attacker need to do to reach root-level code execution?
The attacker needs authenticated WebGUI access as a read-only user with one of the affected page privileges and must install a chosen config.xml. Root-level code execution occurs after the firewall configuration is reloaded or the system is rebooted.
Are default pfSense CE installations affected?
The provided information identifies affected versions through pfSense CE 2.9.0, but does not state whether the required page privileges are assigned to users by default.
How can I determine whether a user account is exposed?
Review WebGUI accounts that are intended to be read-only or are denied Config Write, and check whether they have privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. Such accounts can potentially replace config.xml despite the Config Write denial.