CVE-2026-111217: Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-15 · updated 2026-10-21
Weakness: CWE-78

Description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

Affected products

Netgate pfSense CE: through 2.9.0

References

https://abraxaslabs.tech/research/pfsense-carp-vhid
https://abraxaslabs.tech/research/pfsense-ce-leftovers
https://github.com/abraxas/pfsense-carp-vhid
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200
https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid

Get alerted when CVE-2026-111217 or the next vulnerability affects your stack