CVE-2026-111214

Executive Summary

CVE-2026-111214 is an OS command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0. An authenticated user holding the QinQ edit privilege can store an unvalidated parent interface name via the if parameter and subsequently trigger interpolation of that value into ifconfig shell commands, resulting in command execution as root. Although authentication and a specific privilege are required, successful exploitation yields full root-level compromise of the firewall appliance, making this a high-impact post-authentication escalation and persistence vector.

Technical Analysis

pfSense CE is a widely deployed open-source firewall and routing platform built on FreeBSD. CVE-2026-111214 is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability arises during the configuration of a QinQ (802.1ad stacked VLAN) interface.

Per the NVD description, the flaw is triggered through two distinct configuration actions:

1. Storing the unvalidated value: An authenticated user with QinQ edit privilege saves a crafted value into an if field — described as the "parent interface name." This value is not validated or sanitized at the point of input.
2. Interpolation into shell commands: When the QinQ entry is subsequently edited, the stored if value is interpolated into ifconfig shell commands. Because the value was never sanitized, shell metacharacters carried in the stored string are interpreted by the shell, allowing arbitrary command execution.

The core weakness is the combination of (a) missing input validation on a security-relevant parameter and (b) unsafe construction of a shell command string through interpolation rather than a safe execution API that separates arguments from the command. Because the resulting ifconfig invocation runs in a privileged context, injected commands execute as root.

The if parameter and the ifconfig command are the only implementation-specific identifiers confirmed by the source data. No file paths, function names, or additional endpoints are disclosed in the provided intelligence and none are asserted here.

Affected product range: Netgate pfSense CE 2.7.0 through 2.9.0. No patch has been identified from any tracked source, and no workaround has been published by the vendor according to the data provided.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE; the attack chain below is inferred from the vulnerability class (CWE-78) and the mechanism described in the NVD entry. No specific implementation details beyond those in the description are asserted.

1) Reconnaissance / target identification The attacker must first identify an exposed pfSense CE management interface (webGUI) running an affected version (2.7.0–2.9.0). Administrative interfaces are frequently reachable from internal networks or, when misconfigured, from WAN. The attacker also needs valid credentials for an account that holds the QinQ edit privilege.

2) Triggering the flaw (input validation gap) Using an authenticated session, the attacker creates or edits a QinQ configuration entry and supplies a crafted value in the if (parent interface name) field designed to carry shell metacharacters. Because the value is stored without validation, the malicious string becomes part of the persisted configuration.

3) Execution (command injection) When the attacker (or any subsequent operator) edits the QinQ entry, the stored if value is interpolated into an ifconfig shell command. The shell interprets the injected metacharacters, and the attacker's commands run with root privileges. This is the command-injection primitive at the vulnerability-class level; because the source data does not disclose the exact delimiting characters or payload syntax, no specific payload string is provided.

4) Post-exploitation impact Successful execution as root on a perimeter firewall is a severe outcome. Potential actions consistent with root-level access include: harvesting credentials, private keys, and VPN/secrets stored on the appliance; modifying firewall, NAT, and routing rules; establishing persistence; pivoting into segmented internal networks that trust the firewall; and disabling or altering logging and monitoring.

Prerequisite summary: authenticated access plus the QinQ edit privilege. This limits the attacker population to credentialed, privileged users (or attackers who have already obtained such credentials), which is reflected in the CVSS Privileges Required: High (PR:H) metric.

Impact Assessment

The CVSS v3.1 base score is 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Interpretation of the subscores:

• AV:N (Network): The flaw is exploitable over the network via the management interface.
• AC:L (Low): No special conditions beyond valid privileged access are needed.
• PR:H (High): Attacker must be authenticated with the QinQ edit privilege.
• UI:N (None): No user interaction by a third party is required.
• S:U (Unchanged): Impact is scoped to the vulnerable component.
• C:H / I:H / A:H: High confidentiality, integrity, and availability impact — consistent with root-level command execution on the appliance.

Blast radius: pfSense CE is typically deployed as a network boundary device (firewall, router, VPN gateway). Root compromise of this asset undermines the entire trust boundary it enforces. Business impact includes loss of network segmentation, potential lateral movement into protected segments, exposure of stored secrets and credentials, and integrity loss of security policy. Because exploitation requires a privileged authenticated session, this is most realistically a privilege-escalation and persistence primitive for an insider or an attacker who has already obtained a privileged account. EPSS has not yet been scored by FIRST.org and CISA KEV does not list this CVE, so there is no confirmed evidence of active exploitation.

Detection Guidance

Sigma Rule

title: pfSense CE QinQ Command Injection Attempt (CVE-2026-111214)
id: 8b6f1c2a-3d4e-4f5a-9c1b-7e2f0a9d4c33
status: experimental
description: Detects shell metacharacters submitted in the QinQ parent interface ('if') parameter on pfSense CE management interface.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111214
author: valtersit.com
logsource:
  category: webserver
  product: pfsense
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'qinq'
  selection_payload:
    cs-uri-query|contains:
      - 'if='
    cs-uri-query|re: '(;|\||&|`|\$\(|\$\{|>|<|\n)'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate administrative editing of interface names (rare to contain shell metacharacters)
level: high

YARA Rule

rule CVE_2026_111214_pfSense_QinQ_CMDi
{
    meta:
        description = "Detects command injection payloads targeting pfSense CE QinQ 'if' parameter (CVE-2026-111214)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111214"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $qinq = "qinq" ascii nocase
        $if   = "if=" ascii nocase
        $sh1  = ";" ascii
        $sh2  = "|" ascii
        $sh3  = "&&" ascii
        $sh4  = "`" ascii
        $sh5  = "$(" ascii
        $sh6  = "ifconfig" ascii nocase

    condition:
        $qinq and $if and (any of ($sh*)) and filesize < 512KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111214 pfSense QinQ Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"qinq"; nocase; http.request_body; content:"if="; nocase; pcre:"/(if=)[^&\s]*(;|\||&&|`|\$\(|\$\{)/i"; reference:cve,2026-111214; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-111214; classtype:web-application-attack; sid:2026111214; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where event.category == "web" and
       stringContains(url.path, "qinq", false)]
  [any where event.category == "web" and
       stringContains(url.query, "if=", false) and
       (stringContains(url.query, ";", false) or
        stringContains(url.query, "|", false) or
        stringContains(url.query, "&&", false) or
        stringContains(url.query, "`", false) or
        stringContains(url.query, "$(", false))]

Splunk SPL Query

index=web sourcetype=pfsense
| eval rurl = coalesce(url, uri, cs_uri_stem), rq = coalesce(query, cs_uri_query, form_data)
| where (like(rurl, "%qinq%") OR like(rq, "%if=%"))
       AND (like(rq, "%;%") OR like(rq, "%|%") OR like(rq, "%&&%") OR like(rq, "%\`%") OR like(rq, "%$(%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips values(user) as users
        by rurl, rq
| sort - count

Wazuh OSSEC Rule

<group name="web,pfsense,">
  <rule id="2026112" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>qinq</match>
    <regex>if=[^&amp;\s]*(;|\||&amp;&amp;|`|\$\(|\$\{)</regex>
    <description>CVE-2026-111214: pfSense QinQ command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_111214,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the available data.

1) Immediate mitigations

• Restrict access to the pfSense CE webGUI and SSH interfaces to trusted management networks; never expose the management plane to the internet.
• Enforce least privilege: audit accounts holding the QinQ edit privilege and revoke it from any account that does not strictly require it. Because exploitation requires this specific privilege, tight privilege assignment directly reduces exposure.
• Apply strong authentication (MFA where supported) and monitor for anomalous authenticated sessions.
• Where QinQ is not operationally required, disable/avoid QinQ configuration to remove the attack surface.
• Alert on anomalous ifconfig invocations and unexpected child processes launched from the webGUI context (root-owned processes spawned by the web server are a strong indicator).

2) Patch / upgrade steps

• There is currently no identified fixed version for this CVE. Monitor Netgate's security advisories and pfSense release notes for a patched build covering 2.7.0–2.9.0; upgrade as soon as a fix is published.
• Until a fix exists, treat affected appliances as unpatched and rely on the mitigations above. Validate any vendor guidance against the official Netgate advisory before applying.

3) Long-term hardening

• Maintain an inventory of pfSense CE appliances and their versions; subscribe to Netgate and CISA vulnerability notifications.
• Enforce configuration-change auditing so modifications to interface/QinQ settings are logged and reviewed.
• Adopt network segmentation so that compromise of the firewall does not grant unrestricted lateral movement.
• Ensure backups of configuration and secrets are stored offline/out-of-band so root compromise of the appliance does not expose them.
• Apply the principle that management interfaces must never carry default or shared credentials, and rotate credentials regularly.

References

• NVD — CVE-2026-111214: https://nvd.nist.gov/vuln/detail/CVE-2026-111214
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• Netgate pfSense security advisories (vendor): https://www.netgate.com/security-advisories
• FIRST.org EPSS (not yet scored for CVE-2026-111214): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-111214 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, threat actor campaign, or exploit-in-the-wild evidence is associated with CVE-2026-111214 in the available data. No CISA KEV listing exists. EPSS has not yet been scored.