What’s Vulnerable › Vulnerabilities

CVE-2026-111214: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-15 · updated 2026-10-19
• Weakness: CWE-78

Description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

Affected products

• Netgate pfSense CE: from 2.7.0 through 2.9.0

References

• https://abraxaslabs.tech/research/pfsense-ce-leftovers
• https://abraxaslabs.tech/research/pfsense-qinq-parent-if
• https://github.com/abraxas/pfsense-qinq-parent-if
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L620
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L136
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L212
• https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-interfaces-qinq-edit-php

Get alerted when CVE-2026-111214 or the next vulnerability affects your stack