CVE-2026-111218: pfSense Command Injection RCE Vulnerability

CVE-2026-111218 Overview

CVE-2026-111218 is an operating system (OS) command injection vulnerability in Netgate pfSense Community Edition (CE) versions 2.7.0 through 2.9.0. The flaw resides in the Traffic Shaper Limiters component, where authenticated users with limiter management privileges can inject shell commands through the number field of a limiter definition. When the limiter is subsequently deleted, the delete_queue() function passes the attacker-controlled value to dnctl through /bin/sh executing as root. This produces full root code execution on the firewall appliance from a web-authenticated session. The vulnerability is tracked as [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact

Authenticated attackers with Traffic Shaper Limiters privileges can execute arbitrary commands as root on the pfSense firewall, leading to complete device compromise and lateral movement into protected network segments.

Affected Products

• Netgate pfSense CE 2.7.0
• Netgate pfSense CE versions 2.7.x through 2.8.x
• Netgate pfSense CE 2.9.0

Discovery Timeline

• 2026-10-15 - CVE-2026-111218 published to the National Vulnerability Database (NVD)
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111218

Vulnerability Analysis

The vulnerability lives in src/etc/inc/shaper.inc, which manages the dummynet traffic shaping configuration on pfSense. When a user edits a limiter through the web interface, the backend accepts a hidden number field that identifies the limiter instance for dnctl (the dummynet control utility). The code does not validate or quote this field before passing it to a shell. An attacker who can edit limiters can inject a crafted number value containing shell metacharacters. The payload only triggers when the limiter is deleted, at which point delete_queue() constructs the dnctl command and executes it through /bin/sh as root.

Root Cause

The root cause is the direct concatenation of untrusted user input into a shell command string without escaping or input validation. Lines 3820-3821 and 3959 of shaper.inc build the dnctl invocation using the number value and pass it to a shell interpreter rather than executing the binary directly with argument arrays. Because the pfSense web backend runs with elevated privileges, the resulting command inherits root context.

Attack Vector

Exploitation requires an authenticated session with privileges to manage Traffic Shaper Limiters. The attacker performs two steps. First, the attacker edits or creates a limiter and submits a malicious number value through a tampered HTTP POST request, bypassing the hidden form field. Second, the attacker deletes the limiter, which triggers delete_queue() and executes the injected shell payload as root. Full exploit mechanics are documented by the researchers at Abraxas Labs pfSense Limiter Number Research and the VulnCheck Advisory on pfSense OS Command Injection.

Detection Methods for CVE-2026-111218

Indicators of Compromise

• Unexpected child processes of the pfSense web server (nginx or php-fpm) spawning /bin/sh, dnctl, or arbitrary binaries as root.
• Modifications to /cf/conf/config.xml showing limiter number fields containing shell metacharacters such as ;, |, `, or $().
• Entries in the pfSense audit log recording limiter edits followed closely by limiter deletions from the same user session.
• Outbound network connections initiated from the firewall itself to attacker-controlled infrastructure immediately after limiter deletion events.

Detection Strategies

• Review web UI access logs for POST requests to firewall_shaper_vinterface.php and related limiter endpoints that contain non-numeric characters in the number parameter.
• Baseline process lineage on the firewall and alert on any process spawned by the pfSense PHP backend that is not on an allowlist of legitimate utilities.
• Correlate configuration diffs of config.xml against authenticated user actions to catch tampered limiter definitions before they are triggered.

Monitoring Recommendations

• Forward pfSense system logs, audit logs, and configuration change notifications to a centralized log platform for retention and search.
• Enable alerting on root-level command execution events originating from the web management plane.
• Monitor administrative account usage, especially accounts with Traffic Shaper permissions, for unusual login times or source IP addresses.

How to Mitigate CVE-2026-111218

Immediate Actions Required

• Restrict access to the pfSense web management interface to trusted management networks only, blocking exposure to untrusted or internet-facing segments.
• Audit all accounts with Traffic Shaper Limiters privileges and remove the permission from users who do not require it.
• Rotate credentials for any administrative accounts that may have been exposed, and enforce multi-factor authentication on the web GUI.
• Review config.xml for any limiter definitions containing non-numeric number field values and remove them before deletion.

Patch Information

Refer to the VulnCheck Advisory on pfSense OS Command Injection and the Abraxas Labs pfSense Limiter Number Research for the latest guidance on fixed releases. Administrators should monitor Netgate release notes and apply the vendor patch for pfSense CE as soon as it is published. Until a fix is applied, treat all installations in the 2.7.0 through 2.9.0 range as vulnerable.

Workarounds

• Remove the Traffic Shaper Limiters privilege from all non-administrative roles and limit limiter management to a small set of trusted administrators.
• Place the pfSense web interface behind a VPN or jump host so that only authenticated administrators on the management network can reach it.
• Disable the Traffic Shaper Limiters functionality if it is not in operational use, reducing the attack surface until a patched version is deployed.