CVE-2026-111221: Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-26
Weakness: CWE-93

Description

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.

Affected products

Netgate pfSense CE: through 2.9.0

References

https://abraxaslabs.tech/research/pfsense-ce-leftovers
https://github.com/abraxas/pfsense-l2tp-radius-mpd
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L202-L215
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L428-L441
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_l2tp.php#L137-L143
https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-radius-secret-mpd-conf-injection

Get alerted when CVE-2026-111221 or the next vulnerability affects your stack