CVE-2026-111218
HIGH
CVSS 7.2
Published: 2026-10-15
Modified: 2026-10-15
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Quick Facts
| CVE ID | CVE-2026-111218 |
| CVSS Score | 7.2 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-15 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-limiter-number
- https://github.com/abraxas/pfsense-limiter-number
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333…
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333…
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.…