CVE-2026-111217: pfSense Command Injection RCE Vulnerability

CVE-2026-111217 Overview

CVE-2026-111217 is an OS command injection vulnerability [CWE-78] in Netgate pfSense Community Edition (CE) through version 2.9.0. The flaw resides in how pfSense handles the Common Address Redundancy Protocol (CARP) Virtual Host ID (VHID) parameter when configuring Virtual IPs. Authenticated users holding Virtual IP edit privileges can store a VHID value containing shell metacharacters. The unvalidated value is later passed to ifconfig through interface_ipalias_configure() or rendered via get_carp_interface_status(), triggering command execution as root.

Critical Impact

Authenticated attackers with Virtual IP edit rights gain full root command execution on the pfSense firewall, enabling complete compromise of the perimeter device.

Affected Products

• Netgate pfSense CE versions up to and including 2.9.0
• pfSense firewall deployments exposing the web management interface to privileged operators
• Environments using CARP Virtual IPs for high-availability configurations

Discovery Timeline

• 2026-10-15 - CVE-2026-111217 published to the National Vulnerability Database (NVD)
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111217

Vulnerability Analysis

The vulnerability stems from missing input validation on the CARP VHID field within the Virtual IP configuration workflow. pfSense stores the VHID value verbatim in its configuration XML. When the system subsequently rebuilds interface aliases or renders CARP status in the web UI, the stored VHID is concatenated into shell command strings executed by PHP wrappers around ifconfig.

Two distinct execution sinks exist. interface_ipalias_configure() in src/etc/inc/interfaces.inc invokes ifconfig with the VHID as part of its argument string. get_carp_interface_status() in src/etc/inc/pfsense-utils.inc performs similar shell interpolation when the CARP status page is loaded. Both paths run with root privileges, giving the injected commands full control of the appliance.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The pfSense codebase accepts the VHID without applying numeric validation or shell-metacharacter filtering before persisting it to configuration storage and reusing it in command construction.

Attack Vector

An attacker must first authenticate to the pfSense web interface and possess Virtual IP editing permissions. The attacker edits or creates a CARP Virtual IP and supplies a VHID value containing shell metacharacters such as backticks, semicolons, or command substitution syntax. On save, the payload is written to the pfSense configuration. Execution occurs when interface_ipalias_configure() applies the interface changes or when any administrator loads the CARP status view, invoking get_carp_interface_status(). The injected commands execute as root. Full technical analysis is available in the Abraxas Labs research on pfSense CARP VHID and the VulnCheck advisory.

Detection Methods for CVE-2026-111217

Indicators of Compromise

• Unexpected CARP Virtual IP entries in config.xml containing non-numeric VHID values or shell metacharacters such as ;, |, `, $(, or &&.
• Unusual child processes spawned by the pfSense web server (php-fpm, nginx) or by ifconfig invocations under the root account.
• Outbound network connections from the firewall to unknown hosts shortly after Virtual IP configuration changes.
• New or modified system binaries, cron entries, or SSH authorized_keys files on the pfSense appliance.

Detection Strategies

• Audit the pfSense configuration file for every <vhid> element and alert on values that are not strictly integers within the valid CARP range (1–255).
• Monitor the /var/log/system.log and /var/log/nginx logs for Virtual IP save operations followed by anomalous shell activity.
• Correlate web UI access by privileged users with subsequent process execution anomalies on the appliance.

Monitoring Recommendations

• Forward pfSense syslog and web interface audit events to a centralized SIEM for cross-correlation.
• Enable change tracking on config.xml and alert on modifications to Virtual IP sections.
• Baseline normal process trees for interface_ipalias_configure() executions and alert on deviations.

How to Mitigate CVE-2026-111217

Immediate Actions Required

• Restrict Virtual IP edit privileges to a minimal set of trusted administrators and review existing role assignments.
• Inspect the current pfSense configuration for any CARP VHID values containing non-numeric characters and remove or sanitize them.
• Limit access to the pfSense web management interface to trusted management networks only, blocking exposure to untrusted segments.

Patch Information

At the time of publication, Netgate had not released a fixed version documented in the NVD entry. Operators should monitor the Netgate pfSense project and vendor advisories for a security update that validates the VHID input in interfaces.inc, pfsense-utils.inc, and firewall_virtual_ip.inc. Upgrade to the fixed release as soon as it becomes available.

Workarounds

• Remove or revoke the Virtual IP edit permission from any non-essential accounts until a vendor patch is applied.
• Avoid loading the CARP status page from administrator sessions until stored VHID values have been audited for malicious content.
• Place the pfSense management interface behind an additional authentication layer such as a VPN or jump host.

# Review stored CARP VHID values in pfSense configuration
grep -A2 '<vhid>' /cf/conf/config.xml | grep -v -E '<vhid>[0-9]+</vhid>'