CVE-2026-110908

Executive Summary

CVE-2026-110908 is an OS command injection vulnerability in the Netgate pfSense FRR package (pfSense-pkg-frr), affecting versions 2.0.2_1 and source revision 2.1.2_1. An authenticated WebGUI user holding only the low-privileged page-status-frr privilege can inject shell metacharacters into the FRR status filter, achieving arbitrary command execution as root due to faulty escaping in a single-quoted sed expression passed to a popen() pipeline. With a CVSS score of 8.8, this represents a high-severity privilege escalation and remote code execution risk on affected pfSense firewall deployments.

Technical Analysis

The vulnerability resides in the FRR status filter within the pfSense WebGUI. Specifically, user-supplied filter input is concatenated into a single-quoted sed expression after being processed by escapeshellarg(). The escaping mechanism is insufficient to prevent breakout from the single-quoted context, allowing an attacker to terminate the string and inject shell command substitution syntax. Because the resulting command string is executed via a popen() pipeline, the injected command substitution is evaluated by the shell with root privileges.

This is a classic CWE-78 OS Command Injection. The root cause is the improper handling of shell metacharacters — particularly those enabling command substitution (e.g., backticks or $() ) — when embedding input inside a single-quoted context. escapeshellarg() is designed to escape arguments for safe use as a single argument in a shell command, but concatenating its output into a larger single-quoted expression undermines its protection. The attacker needs only the page-status-frr privilege, which is a low-privilege WebGUI permission intended for viewing FRR routing status. This privilege is commonly delegated to network operations or monitoring personnel, expanding the pool of potential attackers beyond full administrators.

The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and low privileges required (PR:L), no user interaction (UI:N), and results in high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The scope is unchanged (S:U) meaning the vulnerable component and impacted component are the same — however, the impact is root-level command execution on the firewall appliance itself.

The affected component is the pfSense FRR package, which integrates Free Range Routing (FRR) into the pfSense WebGUI. The "FRR status filter" feature is part of the package's status display, likely allowing users to filter routing table output. The insufficient escaping and use of popen() indicate that the WebGUI constructs a shell command to invoke system utilities (e.g., vtysh or similar) with the user's filter as an argument.

No public proof-of-concept exploit code or Nuclei template is currently available. The EPSS score has not yet been assigned by FIRST.org. CISA KEV does not list this CVE. The patch status is considered unpatched per tracked sources despite vendor references to updated packages; this discrepancy likely reflects a lack of confirmation from authoritative patch-tracking feeds.

Exploitation Scenarios

No public PoC available; attack chain is inferred from the vulnerability class and NVD description. The following steps describe the expected exploitation path:

1. Reconnaissance and target identification: The attacker identifies a pfSense appliance running the vulnerable FRR package. This can be done via Shodan dorks such as http.title:"pfSense" or by scanning known management interfaces. The attacker must have valid credentials for a WebGUI account possessing the page-status-frr privilege. Such accounts are often provisioned for monitoring or junior network staff.

2. Triggering the flaw class: The attacker navigates to the FRR status page within the WebGUI. In the filter input field, the attacker supplies a crafted value designed to break out of the single-quoted sed expression. Because the input is concatenated into a single-quoted context, the attacker can inject a closing single quote followed by shell command substitution syntax. For example, a payload could resemble: '; $(malicious_command); ' — though the exact syntax depends on the surrounding command structure. The injected command substitution is then evaluated by the shell because the entire string is passed to popen().

3. Payload execution method: The shell executes the injected command substitution as root. The attacker can run arbitrary system commands, download and execute scripts, add users, modify firewall rules, or establish reverse shells. Since the command executes with root privileges, all restrictions are bypassed.

4. Post-exploitation impact: Successful exploitation grants the attacker full control of the pfSense firewall appliance. This includes access to all network traffic traversing the device, the ability to modify firewall rules, intercept or redirect traffic, exfiltrate configuration data, and pivot into internal networks. The attacker could also disable security controls or install persistent backdoors.

No specific function names, URL paths, or parameter names beyond those in the NVD description (FRR status filter, page-status-frr, escapeshellarg(), popen(), sed) should be assumed or fabricated.

Impact Assessment

The CVSS v3.1 base score of 8.8 is derived from the following subscores:

• Attack Vector (AV): Network — The vulnerability is exploitable remotely via the WebGUI, which is typically exposed on the management interface.
• Attack Complexity (AC): Low — No special conditions or race conditions are required; the injection is straightforward.
• Privileges Required (PR): Low — The attacker needs only a WebGUI account with the page-status-frr privilege, which is a low-privileged role.
• User Interaction (UI): None — No victim interaction is needed; the attacker triggers the exploit directly.
• Scope (S): Unchanged — The vulnerable component (WebGUI) and the impacted component (underlying OS) are considered the same security authority.
• Confidentiality (C): High — Full read access to all data on the appliance, including sensitive configuration and potentially network traffic.
• Integrity (I): High — Full write access to system files, configurations, and the ability to alter network behavior.
• Availability (A): High — The attacker can disrupt or disable the firewall, causing network outages.

Business impact is critical for organizations relying on pfSense as their edge firewall or VPN gateway. A compromised firewall can lead to data breaches, lateral movement, and persistent access to the internal network. The blast radius includes all systems and networks protected by the affected appliance. Because the exploit requires only low privileges, insiders or compromised low-privilege accounts pose a significant threat.

Detection Guidance

Sigma Rule

title: Potential pfSense FRR Status Filter Command Injection
id: 3f9a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit OS command injection in the pfSense FRR status filter via WebGUI requests containing shell metacharacters.
author: Threat Intelligence
date: 2026-07-15
logsource:
  category: webserver
  product: pfsense
detection:
  selection:
    cs-uri-query|contains:
      - 'filter='
      - 'status_frr'
    cs-uri-query|re: '(\$\(|`|;|\|\||&&|\|\s)'
  condition: selection
falsepositives:
  - Legitimate use of filter values containing special characters (unlikely)
level: high
tags:
  - attack.t1190
  - cwe.78

YARA Rule

rule CVE_2026_110908_pfSense_FRR_Command_Injection
{
    meta:
        description = "Detects command injection payloads targeting pfSense FRR status filter"
        author = "Threat Intelligence"
        date = "2026-07-15"
        reference = "CVE-2026-110908"
        severity = "high"

    strings:
        $s1 = "page-status-frr" ascii wide nocase
        $s2 = "status_frr" ascii wide nocase
        $s3 = "escapeshellarg" ascii
        $s4 = "popen" ascii
        $cmd1 = "$(" ascii
        $cmd2 = "`" ascii
        $cmd3 = "; " ascii
        $cmd4 = "||" ascii
        $cmd5 = "&&" ascii
        $sed1 = "sed -e" ascii nocase
        $sed2 = "sed -n" ascii nocase

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x2321) and
        (
            (any of ($s1, $s2) and 2 of ($cmd*)) or
            (any of ($s3, $s4) and any of ($sed*) and 1 of ($cmd*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110908 pfSense FRR Status Filter Command Injection Attempt"; flow:to_server,established; http.uri; content:"status_frr"; http.uri; content:"filter"; http.uri; pcre:"/filter=(?:[^&]*)(?:%24%28|%60|\$\(|`)/i"; reference:cve,2026-110908; classtype:attempted-admin; sid:2026110908; rev:1;)

Elastic Detection

sequence by host.name, user.name with maxspan=5s
  [ network where network.protocol == "http" and
    url.path contains "status_frr" and
    url.query contains "filter" and
    url.query regex~ ".*(\\$\\(|`|;|\\|\\||&&).*" ]

Splunk SPL Query

index=web sourcetype=pfsense OR sourcetype=access_combined
| search uri_path="*status_frr*" OR uri_query="*filter=*"
| regex uri_query="(\\$\\(|`|;|\\|\\||&&)"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri_path, uri_query, user
| sort - count

Wazuh OSSEC Rule

<group name="pfsense,web,attack,">
  <rule id="2026110908" level="12">
    <if_sid>31100</if_sid>
    <decoded_as>web-accesslog</decoded_as>
    <url>status_frr</url>
    <regex url="filter=.*(\$\(|`|;|\|\||&&)</regex>
    <description>CVE-2026-110908: pfSense FRR status filter command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110908,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict WebGUI access to trusted management networks only. Do not expose the pfSense WebGUI to the internet.
   • Review and minimize accounts with the page-status-frr privilege. If the FRR status page is not required for daily operations, remove this privilege from non-essential accounts.
   • Monitor WebGUI logs for suspicious filter values containing shell metacharacters (e.g., $(), backticks, ;, |, &).
   • If feasible, disable the FRR package until an official patch can be applied, provided that routing functionality is not critical or alternative routing management can be used.
   • Implement network segmentation to limit the impact of a compromised firewall appliance.

2. Patch/upgrade steps:

   • Apply the updated FRR packages referenced in the NVD description for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1. Note that patch confidence is currently low (0/4) due to lack of confirmation from tracked patch sources; verify package integrity and vendor advisories before deployment.
   • After patching, perform a thorough audit of system logs and configurations for signs of prior exploitation.
   • Rotate all credentials and secrets stored on or managed by the appliance, as they may have been compromised.

3. Long-term hardening:

   • Enforce the principle of least privilege for all WebGUI accounts. Regularly review and audit user roles and permissions.
   • Implement robust input validation and secure coding practices for any custom packages or scripts. Avoid concatenating user input into shell commands; use parameterized APIs or safe subprocess invocation methods.
   • Deploy network segmentation and zero-trust principles to limit lateral movement from compromised appliances.
   • Enable comprehensive logging and monitoring, including WebGUI access logs, system command execution logs (where available), and network traffic anomaly detection.
   • Subscribe to vendor security advisories and threat intelligence feeds to stay informed about emerging vulnerabilities in pfSense and its packages.

References

1. NVD Entry for CVE-2026-110908: https://nvd.nist.gov/vuln/detail/CVE-2026-110908
2. Netgate pfSense Security Advisories: https://www.netgate.com/security-advisories (verify specific advisory for FRR package updates)
3. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. pfSense FRR Package Documentation: https://docs.netgate.com/pfsense/en/latest/packages/frr.html (for general FRR package information)

No known threat actor campaigns or exploit-in-the-wild evidence are available at this time. CISA KEV does not list this CVE.