CVE-2026-111217 json
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
published 25d ago modified 20d ago also EUVD-2026-102329
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.0%
- EPSS 7.0% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
Is CVE-2026-111217 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 20d ago
Exploit prediction
6.96% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/abraxas/pfsense-carp-vhid referenced PoC, tagged "exploit" by a source, unverified
- abraxaslabs.tech https://abraxaslabs.tech/research/pfsense-carp-vhid referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Netgate pfSense CE
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/abraxas/pfsense-carp-vhid
exploit, technical-description, third-party-advisory
-
abraxaslabs.tech
/research/pfsense-carp-vhid
technical-description, exploit, issue-tracking, mitigation
-
abraxaslabs.tech
/research/pfsense-ce-leftovers
technical-description, issue-tracking
-
github.com
/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virt
technical-description, product
-
github.com
/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238
technical-description, product
-
github.com
/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794
technical-description, product
-
vulncheck.com
/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid
third-party-advisory
Sources
- CVE List CVE-2026-111217
- NVD CVE-2026-111217
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.