CVE-2026-111215: pfSense Command Injection RCE Vulnerability

CVE-2026-111215 Overview

CVE-2026-111215 is an operating system command injection vulnerability in Netgate pfSense CE through version 2.9.0. Authenticated users with limited Wireless Edit or Interface Assignments privileges can execute arbitrary commands as root. The flaw resides in the interface_wireless_clone() function, which interpolates attacker-supplied interface names into an ifconfig shell command without sanitization. Requests submitted through interfaces_wireless_edit.php or interfaces_assign.php reach the vulnerable code path. The weakness maps to CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated low-privilege users can execute arbitrary commands as root on the pfSense firewall, resulting in complete compromise of the perimeter device.

Affected Products

Netgate pfSense CE versions through 2.9.0
interfaces_wireless_edit.php web interface component
interfaces_assign.php web interface component

Discovery Timeline

2026-10-15 - CVE-2026-111215 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111215

Vulnerability Analysis

The vulnerability exists in pfSense CE's wireless interface handling logic. When an administrator or user with Wireless Edit or Interface Assignments privileges submits a wireless parent interface name, the backend interface_wireless_clone() function in interfaces.inc constructs an ifconfig command string using the supplied value. The input is interpolated directly into a shell invocation without escaping or validation. An attacker supplies a value such as ath0;<cmd> which pfSense passes to the system shell, executing <cmd> under the root account that runs the pfSense web backend.

Because pfSense is deployed as a network perimeter firewall, root-level command execution grants control of routing, VPN endpoints, firewall rulesets, and captured traffic. See the VulnCheck Advisory on pfSense OS Command Injection and Abraxas Labs Research on pfSense Leftovers for additional technical analysis.

Root Cause

The root cause is unsanitized string interpolation of a user-controlled interface name into a shell command inside the interface_wireless_clone() function. See the vulnerable logic in the pfSense Interfaces Code Snippet on GitHub. The entry points at the pfSense Wireless Edit Code Snippet and the pfSense Interfaces Assignment Code Snippet do not filter shell metacharacters from the parent interface field.

Attack Vector

An authenticated attacker holding Wireless Edit or Interface Assignments privileges submits a crafted POST request to either interfaces_wireless_edit.php or interfaces_assign.php. The attacker sets the wireless parent interface value to a string containing a shell separator such as ;, |, or backticks, followed by the desired command. When pfSense builds the ifconfig invocation, the shell interprets the metacharacters and runs the attacker command as root. Proof-of-concept tooling is referenced in the GitHub pfSense Wireless Clone Script and GitHub pfSense Assign Interface Script.

Detection Methods for CVE-2026-111215

Indicators of Compromise

Web server access logs showing POST requests to interfaces_wireless_edit.php or interfaces_assign.php from unexpected user accounts or source IP addresses.
Wireless parent interface values in pfSense configuration backups containing shell metacharacters such as ;, |, &, or backticks.
Unexpected child processes of the pfSense php-fpm or lighttpd worker executing shells, nc, wget, curl, or scripting interpreters.
New or modified entries in /etc/rc.conf.local, cron tables, or SSH authorized_keys for the root account outside change windows.

Detection Strategies

Audit the pfSense configuration file config.xml for the <if> element under <wireless> nodes and flag values containing non-alphanumeric characters.
Correlate web UI authentication events with subsequent process execution on the firewall to detect low-privilege users triggering ifconfig or shell invocations.
Alert on ifconfig command lines that include characters outside the expected interface name grammar ([a-zA-Z0-9_]+).

Monitoring Recommendations

Forward pfSense system, authentication, and web UI logs to a centralized log platform for retention and correlation.
Monitor outbound connections initiated by the firewall itself, which should be rare and well-defined, to detect reverse shells spawned via this flaw.
Track administrative role assignments and alert when accounts receive Wireless Edit or Interface Assignments privileges.

How to Mitigate CVE-2026-111215

Immediate Actions Required

Restrict access to the pfSense web management interface to a dedicated management network and trusted administrator workstations.
Review all user accounts and remove Wireless Edit or Interface Assignments privileges from any user who does not require them.
Rotate credentials for all pfSense administrative and operator accounts after confirming no compromise has occurred.
Audit config.xml and system binaries for signs of tampering before applying patches.

Patch Information

Netgate has not published a vendor advisory URL in the enriched data at the time of writing. Administrators should monitor the VulnCheck Advisory on pfSense OS Command Injection and official Netgate release notes for a fixed version beyond pfSense CE 2.9.0, and upgrade as soon as a patched build is available.

Workarounds

Do not grant the Wireless Edit or Interface Assignments privileges to non-administrator users until a patched release is deployed.
Place the pfSense web UI behind a VPN or jump host and block administrative access from untrusted networks.
Enforce multi-factor authentication for all pfSense administrative logins to reduce the risk of credential-based abuse.
Enable configuration change auditing and review config.xml diffs after every wireless interface modification.

bash

# Configuration example: restrict web UI access using the pfSense anti-lockout and firewall rules
# Example pf rule concept to limit WebGUI (TCP/443) to a management subnet 10.10.0.0/24
pass in quick on $mgmt_if proto tcp from 10.10.0.0/24 to (self) port 443 keep state
block in quick on $wan_if proto tcp from any to (self) port { 80 443 }