CVE-2026-111223: pfSense IPsec Configuration Injection RCE

CVE-2026-111223 Overview

CVE-2026-111223 is a command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0. The flaw resides in the IPsec Mobile configuration handler, which writes the login_banner field into strongswan.conf without quoting or sanitization. Authenticated users with IPsec Mobile privileges can submit a single-line banner containing } to escape the unquoted attr plugin value. Attackers then inject charon.start-scripts entries that the charon daemon executes as root on service restart. The weakness is classified as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated attackers with IPsec Mobile privileges gain root command execution on the pfSense host, enabling full compromise of the firewall and any traffic it inspects.

Affected Products

Netgate pfSense CE 2.7.0
Netgate pfSense CE 2.8.x
Netgate pfSense CE 2.9.0

Discovery Timeline

2026-10-15 - CVE-2026-111223 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111223

Vulnerability Analysis

The pfSense IPsec mobile client configuration page accepts a login_banner value from administrators with IPsec Mobile privileges. The backend builds strongswan.conf by concatenating this value directly into the charon.plugins.attr section. Because the generated attribute value was wrapped only in literal double quotes without escaping or structural validation, a crafted banner can terminate the attribute block and introduce new configuration directives. The attacker-controlled directives include charon.start-scripts, which charon executes as root whenever the IPsec service starts or restarts. This converts a configuration write primitive into reliable root command execution on the appliance.

Root Cause

The root cause is unsafe templating of user input into a structured configuration file. In src/etc/inc/ipsec.inc, the login_banner, dns_domain, and dns_split fields were interpolated into strongswan.conf entries using PHP string concatenation surrounded by escaped quotes. The strongswan.conf grammar treats { and } as section delimiters, so an input containing } closes the current block and permits sibling directives. No server-side validation rejected these characters before persisting the configuration.

Attack Vector

Exploitation requires an authenticated session on the pfSense web interface with privileges to edit the VPN › IPsec › Mobile Clients page. The attacker submits a login_banner payload containing } followed by charon.start-scripts { cmd = /path/to/command } style entries. After saving, the attacker triggers an IPsec configuration reload, and charon executes the injected command as root. The attack vector is Network, and no user interaction is required beyond the IPsec service restart that pfSense itself initiates on save.

text

// Patch excerpt - src/etc/inc/ipsec.inc
// Removes invalid quoting of charon attr plugin attributes.
// Fixes injection via login_banner, dns_domain, and dns_split.

		if (!empty($a_client['dns_domain'])) {
			$ssconf['charon']['plugins']['attr'][] = "# Search domain and default domain";
-			$ssconf['charon']['plugins']['attr']['27674'] = "\"{$a_client['dns_domain']}\"";
+			$ssconf['charon']['plugins']['attr']['27674'] = $a_client['dns_domain'];
			if (empty($a_client['dns_split'])) {
-				$ssconf['charon']['plugins']['attr']['27675'] = "\"{$a_client['dns_domain']}\"";
+				$ssconf['charon']['plugins']['attr']['27675'] = $a_client['dns_domain'];
			}
		}

		if (!empty($a_client['login_banner'])) {
			$ssconf['charon']['plugins']['attr'][] = "# Login Banner";
-			$ssconf['charon']['plugins']['attr']['28672'] = "\"{$a_client['login_banner']}\"";
+			$ssconf['charon']['plugins']['attr']['28672'] = $a_client['login_banner'];
		}

Source: pfSense commit 27a52d0807

Detection Methods for CVE-2026-111223

Indicators of Compromise

Presence of } characters or newline sequences inside the login_banner, dns_domain, or dns_split fields in /cf/conf/config.xml.
Unexpected start-scripts or stop-scripts sections within /var/etc/ipsec/strongswan.conf.
charon child processes spawning shells, interpreters, or network tools such as nc, curl, or wget.
Audit log entries showing edits to VPN › IPsec › Mobile Clients followed by IPsec service restarts.

Detection Strategies

Parse strongswan.conf after each configuration change and alert on start-scripts directives that were not administrator-defined.
Compare the running pfSense configuration against a trusted baseline and flag changes to IPsec attr plugin fields that contain shell metacharacters.
Monitor process ancestry for root-owned processes whose parent is charon or ipsec starter.

Monitoring Recommendations

Forward pfSense system and web GUI logs to a centralized SIEM for correlation of configuration changes with service restarts.
Alert on outbound connections originating from the firewall host immediately following IPsec reloads.
Track accounts holding IPsec Mobile privileges and review their activity on a recurring basis.

How to Mitigate CVE-2026-111223

Immediate Actions Required

Upgrade pfSense CE to a build that includes commit 27a52d0807 or later.
Audit the login_banner, dns_domain, and dns_split values in the current configuration and remove any entries containing {, }, or newline characters.
Restrict web GUI access to trusted management networks and enforce multi-factor authentication for administrative accounts.
Review all accounts granted IPsec Mobile privileges and revoke access that is not required.

Patch Information

The fix removes the invalid quoting around charon attr plugin attributes and passes user-supplied values directly to the strongSwan configuration generator, which handles encoding safely. See the pfSense security commit 27a52d0807 and the VulnCheck advisory for release details.

Workarounds

Temporarily disable the IPsec Mobile Clients login banner feature until the patched build is deployed.
Limit the privileges that permit editing VPN › IPsec › Mobile Clients to a small set of trusted administrators.
Monitor and validate strongswan.conf after every configuration save to catch injected directives before service restart.

bash

# Validate current pfSense IPsec configuration for injection artifacts
grep -nE '[{}]|start-scripts|stop-scripts' /var/etc/ipsec/strongswan.conf

# Inspect stored banner value in the pfSense configuration
xmllint --xpath '//ipsec/client/login_banner/text()' /cf/conf/config.xml