CVE-2026-111215

Executive Summary

CVE-2026-111215 is an OS command injection vulnerability in Netgate pfSense CE through version 2.9.0. It allows an authenticated user holding limited Wireless Edit or Interface Assignments privileges to inject arbitrary shell commands — which are executed as root — by supplying a crafted wireless parent interface name containing shell metacharacters (for example, ath0;<cmd>). The flaw is reachable over the network with low attack complexity and requires only high-level privileges, yielding high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). No public exploit or Nuclei template exists, and no vendor patch has been confirmed as of this report.

Technical Analysis

The vulnerability is a classic OS command injection (CWE-78). The root cause is that user-supplied input — specifically the wireless parent interface name — is passed to interface_wireless_clone(), which interpolates that value unescaped into a shell command invoking ifconfig. Because the input is concatenated into a command string without sanitization or escaping, an attacker who can control the parent interface name field can break out of the intended ifconfig argument context using shell metacharacters such as ;.

The attack surface is exposed through two pfSense web GUI endpoints explicitly named in the description:

• interfaces_wireless_edit.php — the Wireless configuration "Edit" page.
• interfaces_assign.php — the Interface Assignments page, where a wireless parent interface can be designated.

Both endpoints accept a wireless parent interface name value that is eventually handled by interface_wireless_clone(). A crafted value of the form ath0;<cmd> causes the shell to interpret everything after the ; as a separate command. Since the underlying web process executes the constructed ifconfig invocation with elevated (root) privileges, the injected command inherits root context.

Key characteristics derived from the description:

• Input vector: Wireless parent interface name field.
• Sink: interface_wireless_clone(), which builds an ifconfig shell command.
• Missing control: No escaping / quoting of the interface name before shell interpolation.
• Privilege context: Commands run as root.
• Access prerequisite: Authentication plus either Wireless Edit or Interface Assignments privileges (both are relatively limited administrative roles, not full superuser).

No further code-level detail (e.g., exact quoting mechanism, exact ifconfig flag layout) is available in the NVD description, and none should be assumed beyond the interpolation-into-shell-command behavior explicitly stated.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the documented vulnerability class and the specific endpoints named in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed pfSense CE management interface (default web GUI). Shodan dorks such as http.title:"pfSense" can locate candidate hosts. The attacker must first obtain credentials that grant at least Wireless Edit or Interface Assignments privileges — these are limited administrative roles, potentially a lower-privileged operator than a full admin.

2. Trigger of the flaw class. After authenticating, the attacker navigates to interfaces_wireless_edit.php or interfaces_assign.php. In the wireless parent interface name field, the attacker supplies a value that begins with a legitimate-looking interface name followed by a command separator, e.g. ath0;<cmd>. This input is stored/submitted and later processed by interface_wireless_clone().

3. Payload / execution method (vulnerability-class level). Because interface_wireless_clone() interpolates the supplied interface name unescaped into an ifconfig shell command, the ; terminates the intended ifconfig invocation and starts a new command (<cmd>). The shell executes <cmd> in the same context as the ifconfig call — namely as root. This is the defining characteristic of OS command injection: an argument field that reaches a shell without escaping.

4. Post-exploitation impact. Successful injection yields root-level code execution on the pfSense appliance. Consequences include full read/write of configuration and credentials, modification of firewall/routing rules, exfiltration of VPN keys and captive-portal data, lateral movement into protected network segments, and the ability to disable logging or auditing. Given pfSense's role as a network edge/perimeter device, root compromise provides a strategic foothold for persistence and man-in-the-middle operations.

Impact Assessment

• Confidentiality (C:H): Root shell access exposes all device secrets and traffic-adjacent data.
• Integrity (I:H): Attackers can alter firewall rules, routing, VPN configuration, and system files.
• Availability (A:H): Root destruction or misconfiguration of networking components can render the device inoperable or cut off network access.
• Scope (S:U): Impact is scored as confined to the vulnerable component (the pfSense device).
• Attack Vector (AV:N): Remotely reachable via the web GUI.
• Attack Complexity (AC:L): No race condition or special conditions required.
• Privileges Required (PR:H): Requires authenticated access with limited administrative privileges; not anonymous.
• User Interaction (UI:N): No victim interaction required beyond the attacker's own authenticated session.

Because pfSense CE is widely deployed as a perimeter firewall/router, a single compromised instance can expose the entire protected network behind it. Blast radius is therefore high for organizations that expose the management GUI or grant Wireless Edit / Interface Assignments rights broadly. The CVSS base score of 7.2 (High) reflects the combination of network reachability, trivial trigger conditions, and full root impact, moderated only by the authentication requirement.

Detection Guidance

Sigma Rule

title: Potential pfSense OS Command Injection via Wireless Parent Interface (CVE-2026-111215)
id: 8f4f3b2a-1c2d-4e5f-9a0b-6c7d8e9f0a1b
status: experimental
description: Detects shell metacharacters appended to a wireless parent interface name field in pfSense web GUI requests targeting interfaces_wireless_edit.php or interfaces_assign.php.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111215
author: threat-intel
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - 'interfaces_wireless_edit.php'
      - 'interfaces_assign.php'
  selection_payload:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate interface names containing encoded characters (rare)
level: high

YARA Rule

rule CVE_2026_111215_pfSense_CmdInjection
{
    meta:
        description = "Detects shell metacharacter injection attempts against pfSense wireless interface parameters"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111215"
        author = "threat-intel"
        date = "2026-01-01"
    strings:
        $ep1 = "interfaces_wireless_edit.php" ascii nocase
        $ep2 = "interfaces_assign.php" ascii nocase
        $sep1 = ";" ascii
        $cmd1 = "ifconfig" ascii nocase
        $cmd2 = "ath0;" ascii nocase
        $cmd3 = "$(" ascii
        $cmd4 = "`" ascii
        $cmd5 = "nc " ascii nocase
        $cmd6 = "wget" ascii nocase
        $cmd7 = "curl" ascii nocase
    condition:
        (any of ($ep*)) and (any of ($sep1,$cmd3,$cmd4)) and (any of ($cmd*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111215 pfSense OS Command Injection Attempt via Wireless Interface Parameter"; flow:to_server,established; content:"interfaces_wireless_edit.php"; http_uri; nocase; content:"ath0;"; http_uri; nocase; reference:cve,2026-111215; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-111215; classtype:web-application-attack; sid:2026111215; rev:1;)

alert http any any -> any any (msg:"CVE-2026-111215 pfSense OS Command Injection Attempt via Interface Assignments"; flow:to_server,established; content:"interfaces_assign.php"; http_uri; nocase; pcre:"/(\;|\||\`|\$\().*(ifconfig|wget|curl|nc)/Ui"; reference:cve,2026-111215; classtype:web-application-attack; sid:2026111216; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "php" and
  process.name in ("sh", "bash", "ifconfig") and
  process.args : "*;*"

Splunk SPL Query

index=web OR index=pfsense sourcetype=access_combined OR sourcetype=php
(cs_uri_stem="*interfaces_wireless_edit.php*" OR cs_uri_stem="*interfaces_assign.php*")
(cs_uri_query="*;*" OR cs_uri_query="*%3B*" OR cs_uri_query="*%60*" OR cs_uri_query="*%24%28*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, cs_uri_stem
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,pfsense,attack,">
  <rule id="100215" level="12">
    <if_sid>31100</if_sid>
    <match>interfaces_wireless_edit.php|interfaces_assign.php</match>
    <regex>\;|\||\`|\$\(</regex>
    <description>CVE-2026-111215: pfSense OS command injection attempt via wireless/interface parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list has been published through tracked sources. The following actions are based on vulnerability-class best practice and the specifics of this CVE.

1) Immediate mitigations

• Restrict access to the pfSense CE web GUI (interfaces_wireless_edit.php, interfaces_assign.php) to trusted management networks only; block external exposure via firewall policy and/or VPN-only access.
• Review and prune accounts holding Wireless Edit or Interface Assignments privileges; these limited roles are sufficient to trigger the flaw. Apply least privilege and remove the capability from non-essential users.
• Deploy the Sigma/Suricata/Wazuh detections above to alert on shell metacharacter usage in wireless/interface parameters.
• Monitor interfaces_wireless_edit.php and interfaces_assign.php requests for ;, |, backticks, and $(...) sequences in parameters.

2) Patch/upgrade steps

• Monitor Netgate's official pfSense CE security advisories and release notes for a fixed release addressing CVE-2026-111215.
• No patch is presently available; do not rely on a fixed version until Netgate confirms one. Track the CVE entry for updates.

3) Long-term hardening

• Never interpolate user input directly into shell commands; use argument-array execution (no shell) or strict allowlisting of interface names validating against a known interface enumeration.
• Apply input validation on the wireless parent interface name to permit only valid alphanumeric/underscore interface identifiers.
• Centralize web GUI access behind an authenticated reverse proxy with WAF rules that reject shell metacharacters in administrative forms.
• Maintain continuous asset inventory of edge appliances and subscribe to Netgate and CISA advisory feeds.

References

• NVD — CVE-2026-111215: https://nvd.nist.gov/vuln/detail/CVE-2026-111215
• CWE-78: Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Netgate pfSense CE Security Advisories: https://www.netgate.com/security-advisories (monitor for CVE-2026-111215 fix; none published at time of writing)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-111215 currently not listed)

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-111215 as of this report. EPSS has not yet been scored by FIRST.org.