What’s Vulnerable › Vulnerabilities

CVE-2026-111220: Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-15
• Weakness: CWE-93

Description

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

Affected products

• Netgate pfSense CE: through 2.9.0

References

• https://abraxaslabs.tech/research/pfsense-ce-leftovers
• https://github.com/abraxas/pfsense-pppoe-cron
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L2174-L2214
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/services.inc#L5652-L5660
• https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_ppps_edit.php#L271-L278
• https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crontab-injection-via-ppp-periodic-reset-ptpid

Get alerted when CVE-2026-111220 or the next vulnerability affects your stack