CVE-2026-111216

Executive Summary

CVE-2026-111216 is an OS command injection vulnerability in Netgate pfSense CE through version 2.9.0 that allows an authenticated user with gateway edit privileges to execute arbitrary commands as root. The flaw resides in the handling of an IPv6 link-local zone index within a gateway Monitor IP, where unvalidated input is passed unescaped to the dpinger shell command via start_dpinger(). With a CVSS score of 7.2, this vulnerability enables full root-level compromise of the firewall appliance, undermining its role as a perimeter security control.

Technical Analysis

pfSense CE is an open-source firewall and router distribution built on FreeBSD, widely deployed as an edge security device. The vulnerable code path is associated with gateway monitoring, specifically the start_dpinger() function, which is responsible for launching the dpinger daemon used to monitor gateway availability.

The vulnerability class is OS command injection (CWE-78). The attack surface is the administrative interface used to configure gateways — specifically the "Monitor IP" field, which accepts an IP address. When an IPv6 link-local address is specified, it may include a zone index (e.g., %em0 or %1). According to the NVD description, the zone index is not validated or escaped before being incorporated into the shell command that invokes dpinger.

The critical mechanics are:

• An authenticated user with gateway edit privileges sets a gateway Monitor IP.
• The zone index portion of an IPv6 link-local address is attacker-controlled and can contain shell metacharacters (e.g., ;, |, $(), backticks).
• When monitoring is applied, start_dpinger() constructs a shell command string using this unvalidated zone value and passes it to the shell without escaping.
• The shell interprets the injected metacharacters, leading to execution of arbitrary commands. Because dpinger and related monitoring processes typically run with elevated privileges, the injected commands execute as root.

No further code-level specifics (e.g., exact shell invocation syntax, additional function names, or file paths) are provided in the available NVD description. The root cause is the failure to sanitize or escape the zone index before shell interpolation.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The following attack chain is inferred strictly from the vulnerability class (OS command injection) and the details provided in the NVD description.

1. Reconnaissance and target identification An attacker identifies a pfSense CE appliance (version ≤ 2.9.0) exposed to the network or accessible from an internal segment. This may be a perimeter firewall or an internal routing device. The attacker must possess valid credentials for the webConfigurator with sufficient privileges to edit gateway settings — typically an administrator or a delegated user with gateway edit rights.

2. Triggering the injection The attacker navigates to the gateway configuration interface and creates or edits a gateway. In the Monitor IP field, they supply an IPv6 link-local address with a zone index containing shell metacharacters. For example, a value such as fe80::1%em0; <payload> — where the portion after the % is the injectable zone. Because the zone index is not validated, the malicious string is accepted.

3. Payload execution When the attacker applies the monitoring configuration (or when the system reapplies gateway monitoring), start_dpinger() builds a shell command that includes the gateway's Monitor IP and its zone index. The unescaped zone index is interpreted by the shell, causing the injected commands to execute. The payload runs with the privileges of the monitoring process — root, as stated in the NVD description. At this stage, the attacker achieves arbitrary command execution on the appliance.

4. Post-exploitation impact With root-level command execution, the attacker can:

   • Read, modify, or exfiltrate sensitive configuration data (e.g., VPN keys, credentials, firewall rules).
   • Establish persistence via cron jobs, shell profiles, or startup scripts.
   • Pivot into internal networks by altering firewall or routing rules.
   • Disable security controls or deploy additional malware.
   • Use the appliance as a beachhead for further lateral movement, since pfSense devices often sit at trust boundaries.

Because the vulnerability requires prior authentication and gateway edit privileges, exploitation is most relevant in scenarios involving:

• Compromised or malicious insider accounts.
• Delegated administrative accounts with excessive privileges.
• Post-compromise escalation from a lower-privileged authenticated user to root.

Impact Assessment

The CVSS 3.1 base score is 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The subscores indicate:

• Attack Vector (Network): Exploitable remotely over the network via the administrative interface.
• Attack Complexity (Low): No special conditions or race conditions required; injection is straightforward once the attacker has the necessary privileges.
• Privileges Required (High): The attacker must already be authenticated with gateway edit rights.
• User Interaction (None): No victim interaction is needed beyond the attacker's own actions.
• Scope (Unchanged): The vulnerable component and impacted component are the same (the pfSense appliance).
• Confidentiality, Integrity, Availability (High): Full loss of confidentiality, integrity, and availability is possible because the attacker gains root access.

Business impact: A pfSense CE appliance is typically a critical network security control. Root compromise means the attacker can bypass, disable, or manipulate all firewall, VPN, and routing functions. The blast radius includes every network segment protected by the device, and the attacker may be able to pivot into internal environments that rely on the firewall for segmentation. The high privileges required reduce the attack surface to authenticated users, but the severity remains high because such accounts are often targeted in credential theft or insider threat scenarios. There is no evidence of active exploitation in the wild or inclusion in CISA KEV at this time.

Detection Guidance

Sigma Rule

title: pfSense Gateway Monitor IP OS Command Injection Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to inject shell metacharacters into the IPv6 link-local zone index within gateway Monitor IP settings on pfSense CE.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: pfsense
detection:
  selection:
    http.url|contains: 'gateway'
    http.method: 'POST'
    http.request_body|re: '(fe80::[^%]*%[^ ]*[;&|`$()])'
  condition: selection
falsepositives:
  - Legitimate IPv6 link-local addresses with unusual zone indices (rare).
level: high
tags:
  - attack.t1190
  - attack.execution

YARA Rule

rule CVE_2026_111216_pfSense_CMD_Injection
{
    meta:
        description = "Detects shell metacharacter patterns in gateway Monitor IP zone index for pfSense CE"
        author = "Threat Intelligence"
        date = "2026-01-01"
        cve = "CVE-2026-111216"
    strings:
        $zone_payload = /fe80::[0-9a-fA-F:]+%[0-9a-zA-Z]+[;|`$()]/
    condition:
        $zone_payload
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111216 pfSense Gateway Monitor IP Command Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"gateway"; http.request_body; pcre:"/fe80::[0-9a-fA-F:]+%[0-9a-zA-Z]+[;|`$()]/i"; reference:cve,2026-111216; classtype:web-application-attack; sid:2026111216; rev:1;)

Elastic Detection

sequence by host.name
  [any where event.category == "web" and http.request.method == "POST" and http.request.body contains "gateway"]
  [any where event.category == "process" and process.parent.name == "start_dpinger" and process.name in ("sh", "csh", "bash")]

Splunk SPL Query

index=web OR index=pfsense sourcetype=access_combined OR sourcetype=pfsense:gui
| search (uri_path="*/gateway*" OR uri_path="*/system_gateways*") AND (http_method="POST")
| regex form_data="fe80::[0-9a-fA-F:]+%[0-9a-zA-Z]+[;|`$()]"
| table _time, src_ip, user, uri_path, form_data
| sort - _time

Wazuh OSSEC Rule

<group name="pfsense,web,">
  <rule id="100216" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.url">gateway</field>
    <field name="http.method">POST</field>
    <regex field="http.request_body">fe80::[0-9a-fA-F:]+%[0-9a-zA-Z]+[;|`$()]</regex>
    <description>CVE-2026-111216: pfSense gateway Monitor IP command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch, or workaround has been identified from tracked sources. The following guidance is based on general security best practices for OS command injection vulnerabilities.

1. Immediate mitigations

   • Restrict access to the pfSense webConfigurator to trusted management networks only. Avoid exposing the administrative interface to the public internet.
   • Enforce least privilege: audit accounts with gateway edit permissions. Remove or downgrade unnecessary privileged accounts.
   • Enable multi-factor authentication for all administrative and delegated accounts where supported.
   • Monitor for unexpected modifications to gateway monitoring configurations and shell process activity originating from the pfSense appliance.
   • If feasible, avoid setting Monitor IPs with IPv6 link-local zone indices until a fixed version is available. Note that this is a configuration workaround, not a fix.

2. Patch/upgrade steps

   • Monitor Netgate's official advisories and pfSense CE release notes for a fixed version. Since pfSense CE through 2.9.0 is affected, an upgrade beyond 2.9.0 will likely address the flaw once released.
   • Subscribe to vendor security announcements and CVE feeds. At time of writing, no patch exists.

3. Long-term hardening

   • Implement strict input validation and output encoding for any user-supplied data that reaches shell commands. Use parameterized APIs or safe process invocation methods (e.g., escapeshellarg() in PHP) instead of shell interpolation.
   • Conduct code review and static analysis focused on command injection sinks, especially for privileged functions like start_dpinger().
   • Adopt a defense-in-depth approach: run monitoring daemons with minimal necessary privileges, use OS-level hardening (e.g., jails), and segment management interfaces.

References

• NVD — CVE-2026-111216: https://nvd.nist.gov/vuln/detail/CVE-2026-111216
• Netgate pfSense Security Advisories: https://www.netgate.com/security-advisories
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (currently unscored): https://www.first.org/epss/