CVE-2026-111221: pfSense Configuration Injection RCE Vulnerability

CVE-2026-111221 Overview

CVE-2026-111221 is a configuration injection vulnerability in Netgate pfSense Community Edition (CE) through version 2.9.0. The flaw lives in how the WebGUI writes RADIUS shared secrets into the mpd5 configuration used by the L2TP and PPPoE servers. Authenticated users with edit privileges on vpn_l2tp.php or services_pppoe_edit.php can submit a secret containing a quote and newline. The unescaped value is written directly into mpd.conf, allowing attackers to append arbitrary mpd5 directives such as an up-script that executes as root when a VPN session starts. The issue is tracked as CWE-93 (Improper Neutralization of CRLF Sequences).

Critical Impact
An authenticated WebGUI user can achieve root code execution on the pfSense host by injecting an up-script directive through a crafted RADIUS shared secret.

Affected Products

Netgate pfSense CE versions up to and including 2.9.0
pfSense CE deployments exposing L2TP Server configuration (vpn_l2tp.php)
pfSense CE deployments exposing PPPoE Server configuration (services_pppoe_edit.php)

Discovery Timeline

2026-10-15 - CVE-2026-111221 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111221

Vulnerability Analysis

The pfSense WebGUI accepts a RADIUS shared secret through the L2TP and PPPoE server edit pages and persists it to config.xml. When the VPN service starts, vpn.inc renders an mpd5 configuration file (mpd.conf) that embeds the secret inside a set radius server directive. The code path does not escape double quotes or newline characters before writing the value. An attacker who can edit the L2TP or PPPoE server configuration terminates the quoted secret, injects a newline, and appends arbitrary mpd5 configuration lines. Because mpd5 runs as root and supports set iface up-script to launch shell commands when a link comes up, injected directives execute with full privileges on the next session establishment. The vulnerability requires authenticated WebGUI access with privileges to edit the affected pages, which limits the attacker population but preserves full host compromise once reached.

Root Cause

The root cause is missing output encoding when user-controlled configuration data is serialized into a sensitive text configuration file. vpn.inc concatenates the RADIUS secret into a quoted mpd5 directive without stripping or escaping CRLF and quote characters. CWE-93 describes exactly this class of control-character injection into structured configuration formats.

Attack Vector

An authenticated attacker with the L2TP or PPPoE Server edit role submits a POST request to vpn_l2tp.php or services_pppoe_edit.php. The RADIUS shared secret field carries a payload that closes the quoted directive, inserts a newline, and adds an up-script line referencing a shell command. After the configuration is saved and the VPN service is restarted or a session is initiated, mpd5 reads the modified mpd.conf and executes the injected command as root. Technical details and proof-of-concept material are published in the Abraxas Labs Research Article, the GitHub pfsense L2TP Project, and the VulnCheck Netgate pfSense Advisory.

No verified exploit code is reproduced here. Refer to the external advisories for the full payload format.

Detection Methods for CVE-2026-111221

Indicators of Compromise

Entries in /var/etc/mpd.conf containing up-script, down-script, or shell metacharacters outside expected quoted secrets.
RADIUS shared secret values in config.xml containing newline (\n, \r) or embedded double-quote characters.
Unexpected root-owned processes spawned by the mpd5 daemon at the moment a VPN session is established.
WebGUI audit log entries showing recent edits to L2TP or PPPoE server configuration by non-administrator accounts.

Detection Strategies

Parse config.xml and alert on any <radius><secret> or equivalent field whose decoded value contains CR, LF, or " characters.
Monitor mpd.conf for the appearance of set iface up-script, set iface down-script, or multi-line secret directives that break the expected single-line format.
Baseline the child process tree of mpd5 and alert on process executions that do not match the known VPN startup profile.
Correlate WebGUI POST requests to vpn_l2tp.php and services_pppoe_edit.php with subsequent root process spawns from mpd5.

Monitoring Recommendations

Forward pfSense system logs, nginx WebGUI access logs, and mpd5 logs to a central SIEM for correlation.
Enable file integrity monitoring on /cf/conf/config.xml and /var/etc/mpd.conf.
Alert on changes to the L2TP or PPPoE server configuration outside of scheduled maintenance windows.
Review WebGUI user roles quarterly to confirm that only administrators hold edit rights on VPN pages.

How to Mitigate CVE-2026-111221

Immediate Actions Required

Restrict WebGUI access to trusted management networks and enforce multi-factor authentication for all administrative accounts.
Audit RADIUS shared secrets currently stored in config.xml and remove any value containing CRLF or quote characters.
Revoke L2TP and PPPoE Server edit privileges from any account that does not require them.
Monitor the Netgate security advisory channel for a patched pfSense CE release addressing CVE-2026-111221.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for Netgate pfSense CE. Administrators should track the VulnCheck Netgate pfSense Advisory and the upstream pfSense VPN Configuration Snippet for a corrected vpn.inc that escapes RADIUS secrets before writing mpd.conf.

Workarounds

Disable the L2TP Server and PPPoE Server services on pfSense CE until a patched release is available.
If RADIUS authentication must remain enabled, rotate shared secrets to values containing only alphanumeric characters and no quotes or control bytes.
Place the WebGUI behind a VPN or management jump host and block direct access from untrusted networks.
Apply strict role-based access control so only trusted administrators can modify VPN configuration pages.

bash

# Example: temporarily disable the L2TP server via pfSense shell
# (run from the pfSense console, option 8)
service mpd5 stop
pfSsh.php playback disablevpnservice l2tp