CVE-2019-11816

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-20 · updated 2026-06-17

Description

Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.

Affected products

Netgate pfSense: through 2.4.4; 2.4.4-p1, 2.4.4-p2
OPNsense: before 19.1.8 — fixed in 19.1.8

How to fix

Upgrade to a fixed version: OPNsense 19.1.8. Check the vendor advisory for mitigations.

References

https://forum.opnsense.org/index.php?topic=12787.0
https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html
https://forum.opnsense.org/index.php?topic=12787.0
https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html

Get alerted when CVE-2019-11816 or the next vulnerability affects your stack