CVE-2026-110908 Overview
CVE-2026-110908 is an OS command injection vulnerability in the Netgate pfSense FRR package (pfSense-pkg-frr) versions 2.0.2_1 and source revision 2.1.2_1. The flaw resides in the FRR status filter within status_frr.php. An authenticated WebGUI user holding only the page-status-frr privilege can supply a crafted filter value that escapes a single-quoted sed expression. The output of escapeshellarg() is concatenated into that expression, allowing shell command substitution to execute through a popen() pipeline. Attacker-supplied commands run as root on the pfSense host.
Critical Impact
A low-privilege authenticated WebGUI user can achieve root-level remote code execution on the firewall, compromising the perimeter security device entirely.
Affected Products
- Netgate pfSense FRR package (pfSense-pkg-frr) version 2.0.2_1
- Netgate pfSense FRR package source revision 2.1.2_1
- pfSense Plus 26.07 and 26.03.1, and pfSense CE 2.9.0 and 2.8.1 prior to updated FRR packages
Discovery Timeline
- 2026-10-15 - CVE-2026-110908 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-110908
Vulnerability Analysis
The vulnerability is categorized as OS Command Injection [CWE-78]. The FRR status page in pfSense accepts a user-supplied filter string that is passed into a sed expression executed through popen(). Although the developers wrapped the user input with escapeshellarg(), the resulting single-quoted token is then concatenated into another single-quoted sed script. This nesting breaks the intended quoting boundary, letting attacker input terminate the sed string and inject shell metacharacters.
Because the FRR status page runs with root privileges, injected shell command substitutions execute as root. The attacker needs only the page-status-frr WebGUI privilege, which is far below administrator level. On a perimeter firewall, root code execution grants full control over routing, firewall rules, VPN termination, and traffic inspection.
Root Cause
The root cause is unsafe composition of shell commands in the FRR status filter handler. escapeshellarg() protects a value only when used as a standalone argument. In this code path, the escaped value is embedded inside another quoted shell construct, so the escaping no longer prevents injection. See the vulnerable code at GitHub FRR Configuration Script.
Attack Vector
Exploitation requires network access to the pfSense WebGUI and valid credentials for an account with the page-status-frr privilege. The attacker submits a filter parameter containing single-quote and backtick or $() sequences to break out of the sed expression. The crafted payload is piped through popen() and the shell evaluates the injected command substitution as root. Technical references are tracked in pfSense Issue Tracker #17134.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-110908
Indicators of Compromise
- Unexpected child processes spawned by the pfSense WebGUI php-fpm or nginx worker, especially shells (sh, bash) or network tools (nc, curl, wget) running as root.
- Web server access logs showing POST or GET requests to status_frr.php containing single quotes, backticks, $(, or shell metacharacters in filter parameters.
- New or modified cron entries, SSH authorized_keys, or firewall rules created outside of administrator sessions.
Detection Strategies
- Audit the pfSense nginx access log for requests to /status_frr.php with suspicious filter query strings or POST bodies.
- Alert on process-lineage anomalies where php-fpm spawns sed which then spawns an interactive shell or network utility.
- Correlate authenticated WebGUI sessions holding only page-status-frr with any subsequent system-level configuration change.
Monitoring Recommendations
- Forward pfSense system and web logs to a central SIEM for retention and correlation of filter-parameter payloads.
- Monitor outbound connections initiated directly from the firewall host, which is unusual for a pfSense appliance.
- Track installed package versions across pfSense fleet and alert when pfSense-pkg-frr remains below the fixed release.
How to Mitigate CVE-2026-110908
Immediate Actions Required
- Update pfSense-pkg-frr to the fixed version on pfSense Plus 26.07/26.03.1 or pfSense CE 2.9.0/2.8.1.
- Review all WebGUI user accounts and remove the page-status-frr privilege from accounts that do not require it.
- Rotate credentials for any account that held page-status-frr and audit configuration changes made since package installation.
Patch Information
Netgate has released updated FRR packages for pfSense Plus 26.07, pfSense Plus 26.03.1, pfSense CE 2.9.0, and pfSense CE 2.8.1. Administrators should install the updated package through the pfSense Package Manager. Tracking details are available in pfSense Issue Tracker #17134.
Workarounds
- Uninstall the FRR package temporarily if dynamic routing is not required and patching cannot be performed immediately.
- Restrict WebGUI access to a management VLAN or VPN and enforce source-IP allowlists on the WebGUI listener.
- Remove the page-status-frr privilege from all non-administrative roles until the patched package is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
