CVE-2026-111219 Overview
CVE-2026-111219 is a newline injection vulnerability in Netgate pfSense CE through version 2.9.0. The flaw resides in services_pppoe_edit.php, which fails to validate newline characters in the PPPoE username POST field. Privileged web UI users with the PPPoE Server Edit permission can inject arbitrary entries into the mpd.secret configuration file. When an injected secret begins with the ! character, mpd5 interprets it as a shell command and executes it as root upon PPPoE client authentication. The vulnerability chains an input validation flaw [CWE-93] with a documented mpd5 feature to achieve privileged command execution.
Critical Impact
Authenticated web UI operators with PPPoE Server Edit rights can execute arbitrary commands as root on the pfSense host, fully compromising the firewall.
Affected Products
- Netgate pfSense CE versions up to and including 2.9.0
- services_pppoe_edit.php web interface component
- mpd5 PPPoE server daemon integration
Discovery Timeline
- 2026-10-15 - CVE-2026-111219 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-111219
Vulnerability Analysis
The vulnerability stems from improper neutralization of CRLF sequences in the PPPoE username field submitted through services_pppoe_edit.php. The web form writes user-supplied values directly into the mpd5 secrets file without stripping or escaping newline characters. An attacker with PPPoE Server Edit privileges can submit a username containing a newline followed by a crafted secret entry. The injected line becomes an independent record in mpd.secret.
The mpd5 daemon treats secret values beginning with ! as external commands to execute. When a PPPoE client subsequently authenticates against the injected username, mpd5 invokes the shell command referenced after the ! sentinel. Because mpd5 runs with root privileges on pfSense, the command executes with full system authority. The attack requires an authenticated privileged user and a triggering PPPoE authentication event, which lowers the practical attack surface but allows durable persistence.
Root Cause
The root cause is missing input validation in the PPPoE edit handler at src/usr/local/www/services_pppoe_edit.php lines 141-152, combined with unsanitized secret serialization in src/etc/inc/vpn.inc lines 272-282. Neither code path rejects or escapes newline characters before writing to mpd.secret. The mpd5 ! command feature compounds the issue by granting shell execution semantics to any attacker-controlled secret line.
Attack Vector
An attacker first authenticates to the pfSense web interface with an account holding the PPPoE Server Edit privilege. The attacker then submits a crafted username containing a URL-encoded newline followed by a username and a secret beginning with ! and the desired shell command. The config is persisted and mpd5 is reloaded. When any PPPoE client (which the attacker can initiate) authenticates with the injected username, mpd5 executes the attached command as root. Technical analysis is available in the Abraxas Labs research and the Vulncheck advisory.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-111219
Indicators of Compromise
- Entries in /var/etc/mpd.secret where the secret field begins with the ! character
- Unexpected lines in mpd.secret containing shell metacharacters, pipes, or absolute binary paths
- Audit log entries showing POST requests to services_pppoe_edit.php containing URL-encoded %0A or %0D sequences in the username parameter
- mpd5 process spawning unexpected child processes such as /bin/sh, nc, curl, or wget
Detection Strategies
- Parse mpd.secret on each pfSense host and alert on any line whose second field starts with !
- Monitor Apache/nginx access logs for PPPoE edit requests that contain encoded newline characters in form fields
- Baseline the parent-child process tree of mpd5 and alert on any non-standard descendants
Monitoring Recommendations
- Forward pfSense system logs, web UI audit trails, and mpd5 output to a centralized SIEM for correlation
- Enable file integrity monitoring on /var/etc/mpd.secret and /cf/conf/config.xml to catch unauthorized edits
- Review PPPoE server user accounts regularly for unexpected or malformed entries
How to Mitigate CVE-2026-111219
Immediate Actions Required
- Audit all pfSense administrator accounts and remove the PPPoE Server Edit privilege from users who do not require it
- Inspect mpd.secret on every pfSense CE host for lines containing the ! command sentinel and remove any unauthorized entries
- Restrict web UI access to trusted management networks using firewall rules and VPN enforcement
Patch Information
At the time of publication, no official Netgate patch reference is listed in the NVD data for CVE-2026-111219. Administrators should monitor the pfSense repository and Netgate security advisories for an updated release addressing the newline injection in services_pppoe_edit.php and the secret serialization logic in vpn.inc. Upgrade from pfSense CE 2.9.0 or earlier as soon as a fixed version becomes available.
Workarounds
- Disable the PPPoE server service if it is not required for the deployment
- Remove PPPoE Server Edit from all non-root operator roles and limit configuration changes to the primary administrator account
- Apply a local configuration review script that rejects any mpd.secret entry beginning with ! before mpd5 is reloaded
- Place the pfSense management interface behind a bastion host or management VLAN to reduce the pool of accounts that could abuse the privilege
# Configuration example: detect injected mpd.secret command entries
awk '{ if ($2 ~ /^"?!/) print FILENAME": suspicious entry -> "$0 }' /var/etc/mpd.secret
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
