CVE-2026-111216 Overview
CVE-2026-111216 is an OS command injection vulnerability [CWE-78] in Netgate pfSense Community Edition (CE) through version 2.9.0. Authenticated users with gateway edit privileges can execute arbitrary commands as root by injecting shell metacharacters into an IPv6 link-local zone index. The attacker sets a gateway Monitor IP whose unvalidated zone carries the payload. The start_dpinger() function then passes the value unescaped to the dpinger shell command when monitoring is applied. The flaw affects the pfSense CE firewall platform used in network perimeter and segmentation deployments.
Critical Impact
Authenticated administrators with gateway edit privileges can achieve root command execution on the pfSense firewall, compromising the entire network boundary.
Affected Products
- Netgate pfSense Community Edition (CE) through 2.9.0
- pfSense CE deployments exposing gateway monitoring via the web UI
- Any pfSense CE host where IPv6 link-local gateways are configurable
Discovery Timeline
- 2026-10-15 - CVE-2026-111216 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-111216
Vulnerability Analysis
The vulnerability resides in the gateway load-balancer logic (gwlb.inc) that constructs the command line for the dpinger monitoring daemon. When a gateway Monitor IP is an IPv6 link-local address, pfSense appends a zone index in the form fe80::1%ifname to scope the address to an interface. The code path through start_dpinger() concatenates the user-supplied zone component into a shell command without escaping or validating characters. Any shell metacharacter supplied through the zone is interpreted by the shell at process invocation.
Root Cause
The root cause is missing input sanitization on the IPv6 zone index field before it is passed to a shell interpreter. The utility routine referenced in util.inc does not reject or escape metacharacters such as ;, |, `, $(...), or whitespace. Because dpinger is launched by the pfSense service manager as root, injected commands inherit full privilege.
Attack Vector
Exploitation requires an authenticated web session with permission to edit gateways. The attacker configures or edits a gateway, supplies an IPv6 link-local Monitor IP whose zone portion embeds a command payload, and triggers monitoring. When start_dpinger() builds and executes the command, the payload runs as root. The attack is network-reachable through the pfSense web interface and leverages the firewall's own service invocation to escalate from administrative web privileges to full operating system control.
No verified public proof-of-concept code is published. See the VulnCheck Netgate pfSense Advisory and Abraxas Labs Research for additional technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-111216
Indicators of Compromise
- Gateway configuration entries in config.xml containing shell metacharacters (;, |, `, $, newline) within Monitor IP or IPv6 zone fields.
- Unexpected root-owned child processes spawned by dpinger or by the pfSense PHP service manager.
- New or modified cron entries, SSH keys, or user accounts appearing shortly after gateway edits in the audit log.
- Outbound connections initiated by the firewall host to unknown destinations following gateway monitoring restarts.
Detection Strategies
- Audit /cf/conf/config.xml and backups for <monitor> or gateway entries containing non-address characters.
- Inspect dpinger command lines in process listings for arguments beyond expected IP, interface, and socket paths.
- Correlate pfSense web UI gateway-edit events with subsequent process-creation telemetry on the firewall host.
Monitoring Recommendations
- Forward pfSense syslog, audit, and dpinger logs to a centralized SIEM for inspection.
- Alert on configuration changes to gateway objects made by non-standard administrator accounts.
- Baseline the expected dpinger command structure and alert on deviations such as embedded shell operators.
How to Mitigate CVE-2026-111216
Immediate Actions Required
- Restrict web UI access to the pfSense management interface to trusted administrative networks only.
- Review all accounts with gateway edit privileges and remove unnecessary administrative access.
- Audit existing gateway Monitor IP values for unexpected characters and reset any suspicious entries.
- Rotate credentials and inspect the firewall host for persistence if unauthorized gateway edits are discovered.
Patch Information
Netgate pfSense CE versions through 2.9.0 are affected. Upgrade to a fixed release once published by Netgate. Monitor the VulnCheck Netgate pfSense Advisory and official Netgate release notes for the specific patched version. Review the vulnerable code paths referenced in the gwlb.inc source and util.inc source.
Workarounds
- Avoid configuring IPv6 link-local addresses as gateway Monitor IPs until the system is patched.
- Enforce multi-factor authentication on the pfSense web UI to reduce the risk of credential compromise leading to exploitation.
- Limit the number of accounts holding the WebCfg - System: Gateways privilege to the minimum necessary.
- Place the pfSense management interface behind a VPN or jump host to eliminate direct network exposure.
# Configuration example: restrict management interface access via firewall anti-lockout rule tuning
# Replace 10.0.0.0/24 with your trusted admin network
pfctl -a management -f - <<EOF
block in quick on $wan_if proto tcp to (self) port { 80 443 }
pass in quick on $mgmt_if proto tcp from 10.0.0.0/24 to (self) port { 443 }
EOF
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
