CVE-2026-111217

Executive Summary

CVE-2026-111217 is an OS command injection vulnerability (CWE-78) in Netgate pfSense CE through version 2.9.0 that allows authenticated users possessing Virtual IP edit privileges to execute arbitrary commands as root by supplying an unvalidated CARP VHID value. Because the affected role is a routine administrative delegation in many environments, the flaw enables authenticated privilege escalation to full root-level code execution on the firewall. The vulnerability is currently unpatched (patch confidence 0/4) and no public proof-of-concept or exploit code is known to exist.

Technical Analysis

pfSense Community Edition is a widely deployed open-source firewall and routing platform. The vulnerability resides in the handling of the CARP (Common Address Redundancy Protocol) Virtual Host ID (VHID) associated with Virtual IP configuration.

According to the NVD description, the root cause is a failure to validate the CARP VHID before it is used in a context where it is passed to a shell. An authenticated user who holds Virtual IP edit privileges can store a VHID value containing shell metacharacters. The tainted VHID is subsequently consumed in two described locations:

1. interface_ipalias_configure() — the routine that applies IP alias / Virtual IP configuration, which issues ifconfig calls. Because the VHID is incorporated into a shell command string without sanitization, embedded metacharacters are interpreted by the shell rather than treated as literal data.
2. get_carp_interface_status() — invoked when CARP status is rendered. The stored, unvalidated VHID flows into this rendering path and is again interpreted by a shell.

This is a classic second-order (stored) OS command injection: the malicious value is persisted during configuration, then executed whenever the affected code path runs — at configuration time via interface_ipalias_configure() and at status-render time via get_carp_interface_status(). Because the underlying services run with elevated privileges, the injected commands execute as root.

The relevant CWE is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The attack surface is the webConfigurator administrative interface, reachable over the network (AV:N). Successful exploitation requires high privileges (PR:H) — specifically the delegated Virtual IP edit capability — but no user interaction (UI:N).

No specific patch, function-level code fix, or vendor advisory has been identified, so the precise neutralization approach (escaping vs. argument-vector invocation) cannot be confirmed from available data.

Exploitation Scenarios

The following chain is derived strictly from the NVD description and the vulnerability class. No public PoC exists; the chain is inferred from the stored OS command injection class.

1. Reconnaissance / target identification. An attacker identifies a pfSense CE host (<= 2.9.0) reachable via its webConfigurator administrative interface. This can be a legitimate low-privilege administrative account or an account whose privileges have been delegated to manage Virtual IPs.

2. Triggering the flaw class. The attacker authenticates and, using Virtual IP edit privileges, creates or edits a Virtual IP entry, supplying a CARP VHID value that contains shell metacharacters instead of a legitimate numeric VHID. Because the value is not validated or neutralized before storage, it is persisted.

3. Execution. The injected value is interpreted when configuration is applied — through interface_ipalias_configure(), which constructs ifconfig shell calls — or when CARP status is rendered via get_carp_interface_status(). At that point the shell metacharacters are parsed by the shell, and the attacker's command runs with the privileges of the invoking service (root).

4. Post-exploitation impact. Root-level command execution on the firewall yields complete confidentiality, integrity, and availability impact (CVSS C:H/I:H/A:H): credential and key theft, firewall rule and VPN manipulation, traffic interception, lateral movement into protected network segments, and potential persistence.

No public exploit code or Nuclei template exists for this CVE; exploitation requires authenticated access with the specific privilege noted above.

Impact Assessment

The CVSS 3.1 base score is 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (High): root access exposes configuration secrets, certificates, VPN keys, and traffic.
• Integrity (High): firewall, routing, and CARP configuration can be altered arbitrarily.
• Availability (High): services, interfaces, and clustering can be disrupted.
• Privileges Required (High): the attacker must already hold Virtual IP edit privileges, which limits initial access but does not limit impact once exploited.
• Scope (Unchanged): impact is confined to the vulnerable host's security authority.

Blast radius is significant: pfSense commonly sits at network perimeters and inter-segment boundaries, so root compromise can undermine the trust boundary the appliance is meant to enforce. Environments using CARP for high-availability failover are especially relevant because both exploitation paths center on CARP/VHID handling. No EPSS score is available and the CVE is not listed in CISA KEV; there is no evidence of in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Potential pfSense CARP VHID Command Injection (CVE-2026-111217)
id: 3f9c1a7e-2b4d-4e8a-9c11-pfsense-carp-vhid
status: experimental
description: Detects shell metacharacters submitted in pfSense Virtual IP / CARP VHID configuration fields.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111217
author: valtersit.com
logsource:
  product: webserver
  service: http
detection:
  selection_method:
    cs-method:
      - POST
      - GET
  selection_path:
    cs-uri-stem|contains:
      - 'firewall_virtual_ip'
      - 'carp'
      - 'virtual_ip'
  selection_meta:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
      - '>'
      - '<'
  condition: selection_method and selection_path and selection_meta
falsepositives:
  - Legitimate administrative input (unlikely for a numeric VHID field)
level: high

YARA Rule

rule CVE_2026_111217_pfSense_CARP_VHID_CommandInjection
{
    meta:
        description = "Detects shell metacharacters in CARP VHID values within pfSense config/log artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111217"
        cve = "CVE-2026-111217"
        date = "2026-01-01"
    strings:
        $vhid = "vhid" nocase
        $carp = "carp" nocase
        $meta1 = ";"
        $meta2 = "&&"
        $meta3 = "$("
        $meta4 = "|"
        $meta5 = "`"
    condition:
        ($vhid or $carp) and 1 of ($meta*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111217 pfSense CARP VHID Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"virtual_ip"|nocase; http.uri; content:"carp"|nocase; http.request_body; content:"vhid"|nocase; pcre:"/vhid[^&]*[\x3b\x7c\x26\x60\x24\x3c\x3e\x28]/i"; classtype:web-application-attack; reference:cve,2026-111217; sid:2026111217; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where http.request.method == "POST" and
      stringContains(http.request.body, "vhid") and
      (stringContains(http.request.body, ";") or
       stringContains(http.request.body, "$(") or
       stringContains(http.request.body, "|") or
       stringContains(http.request.body, "`")) ]
  [ process where process.name == "ifconfig" or process.args : "*carp*" ]

Splunk SPL Query

index=web OR index=firewall sourcetype=access_combined OR sourcetype=suricata
| search (uri_path="*virtual_ip*" OR uri_path="*carp*")
| regex form_data="(?i)vhid[^&]*(;|\||&&|`|\$\(|>|<)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, form_data
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,pfsense,cve-2026-111217,">
  <rule id="202611217" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/.*(virtual_ip|carp).*/</url>
    <regex type="pcre2">(?i)vhid[^&amp;]*(;|\||&amp;&amp;|`|\$\(|&gt;|&lt;)</regex>
    <description>CVE-2026-111217: Possible pfSense CARP VHID command injection attempt (shell metacharacters in Virtual IP config).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_111217,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory is available from the data provided.

1. Immediate mitigations

   • Restrict and audit who holds Virtual IP edit privileges; treat any delegation of this role as equivalent to high-risk administrative access.
   • Limit access to the webConfigurator administrative interface to trusted management networks, and enforce MFA on administrative accounts.
   • Monitor for shell metacharacters in Virtual IP / CARP VHID configuration submissions using the detection content above.
   • Where CARP Virtual IP management is not required, remove the delegated capability from non-essential accounts.

2. Patch / upgrade steps

   • No patch is currently available. Track Netgate pfSense CE release notes and security advisories for a fixed version. Until a fix is published, do not assume any CE version through 2.9.0 is safe.

3. Long-term hardening

   • Adopt strict input validation for all configuration fields, treating VHID and similar numeric fields as bounded integers.
   • Apply the principle of least privilege to administrative role assignment and review it periodically.
   • Log and alert on configuration changes to CARP/Virtual IP objects and on ifconfig invocations originating from the webConfigurator process.

References

• NVD — CVE-2026-111217: https://nvd.nist.gov/vuln/detail/CVE-2026-111217
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Netgate pfSense CE — product and release information: https://www.netgate.com/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-111217 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing.