CVE-2026-111218

Executive Summary

CVE-2026-111218 is an OS command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0, affecting the Traffic Shaper Limiters functionality. An authenticated attacker holding Traffic Shaper Limiters privileges can execute arbitrary root-level commands by tampering with the limiter number field, submitting a malicious hidden number value during a limiter edit, and then deleting the limiter so that the delete_queue() logic passes the unquoted value to dnctl through /bin/sh as root. With a CVSS score of 7.2 (High), the flaw delivers complete confidentiality, integrity, and availability impact to the compromised appliance, effectively granting a lower-privileged administrative user full root control over the firewall.

Technical Analysis

The vulnerability resides in the pfSense CE Traffic Shaper Limiters subsystem, where administrative users with delegated limiter privileges interact with the limiter management interface. According to the NVD description, the flaw is a classic OS command injection (CWE-78) that manifests when an authenticated user tampers with the limiter "number" field.

The attack mechanism proceeds in two phases:

1. Injection phase — The attacker submits a malicious hidden number value while editing a limiter. The value is accepted without effective sanitization and stored in the limiter configuration.

2. Trigger phase — When the attacker subsequently deletes the limiter, the delete_queue() routine processes the stored number value. Because the value is passed unquoted to the dnctl binary through /bin/sh, shell metacharacters embedded in the number field are interpreted by the shell rather than treated as literal data. This allows arbitrary command execution with root privileges, since the pfSense web configuration backend operates as root.

The root cause is the failure to apply shell-escaping or argument-array invocation when constructing the dnctl command line. Any value reaching delete_queue() and forwarded to /bin/sh must be treated as untrusted, but the vulnerable versions pass it raw. The observable code entities named in the source description (delete_queue(), dnctl, /bin/sh) are the exact components involved; no additional internal function or endpoint names should be assumed beyond these.

The attack surface is the authenticated pfSense web GUI/API for Traffic Shaper Limiters, reachable over the network (AV:N). Complexity is Low (AC:L), as no race condition or specialized conditions are needed. Privileges Required are High (PR:H) because the attacker must already hold limiter-management access — a delegated administrative role, not anonymous access. No user interaction is required (UI:N).

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification — The attacker identifies a pfSense CE appliance running a version in the 2.7.0–2.9.0 range (e.g., via the login portal, version banners, or SSL certificate subject). The attacker must possess valid credentials for an account granted Traffic Shaper Limiters privileges.

2. Privilege-context establishment — The attacker authenticates to the web interface with the limiter-management account. This is the minimum privilege needed to reach the vulnerable functionality; it is not a full administrator.

3. Triggering the flaw class — The attacker edits a limiter and supplies a crafted value in the hidden number field. Because this value is later consumed unquoted by delete_queue() and passed to dnctl via /bin/sh, shell metacharacters within the value become executable. The specific payload construction should be understood at the command-injection class level (shell metacharacter concatenation leading to command substitution); no exact payload syntax is documented publicly.

4. Execution — The attacker triggers deletion of the tampered limiter, causing delete_queue() to hand the unquoted value to /bin/sh. The injected command runs as root on the appliance.

5. Post-exploitation impact — With root command execution on a perimeter firewall, the attacker can read/modify configuration, exfiltrate credentials and VPN keys, install persistence, pivot into protected network segments, or disable logging and filtering. Full CIA impact applies.

Impact Assessment

CVSS v3.1 base score is 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality: High — Root access exposes configuration secrets, hashed credentials, certificates, and VPN material.
• Integrity: High — The attacker can alter firewall, routing, and shaper configuration, or plant code.
• Availability: High — Root on the appliance enables denial of service, rule manipulation, or total reconfiguration.
• Scope: Unchanged — The vulnerable component (pfSense appliance) and impacted component are the same.
• Attack Vector: Network, Complexity: Low, Privileges Required: High, User Interaction: None.

The blast radius is substantial: pfSense CE commonly sits at network perimeters, so a compromised instance can expose or redirect all downstream traffic. The elevated privilege requirement (PR:H) somewhat limits exposure to insiders, delegated operators, or attackers who first obtain a limiter-management account through credential theft or weak access control. Because the flaw is UNPATCHED (0/4 patch confidence) and no exploit or PoC is publicly available, near-term exploitation is more likely from a targeted, technically capable adversary than from commodity scanning.

Detection Guidance

Sigma Rule

title: pfSense CE Limiter Command Injection via number Field (CVE-2026-111218)
id: 3f9c1a72-2b4e-4d18-9a6f-pfsense-limiter-rce
status: experimental
description: Detects editing of Traffic Shaper Limiters with shell metacharacters in the hidden number field, or dnctl invocations spawned by the web backend, consistent with CVE-2026-111218.
logsource:
  product: pfsense
  service: webgui
detection:
  selection_edit:
    http.method: 'POST'
    http.url|contains: 'limiter'
    body|contains:
      - 'number='
    body|re: '(number=[^&]*[;&|`$()])'
  selection_proc:
    process.parent.name: 'php-fpm'
    process.name: 'dnctl'
  condition: selection_edit or selection_proc
falsepositives:
  - Legitimate limiter edits containing unusual characters (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.111218

YARA Rule

rule CVE_2026_111218_PfSense_Limiter_Injection
{
    meta:
        description = "Detects shell metacharacter payloads targeting pfSense Traffic Shaper Limiter number field (CVE-2026-111218)"
        author = "Threat Intelligence"
        date = "2025-01-01"
        reference = "CVE-2026-111218"
        severity = "high"

    strings:
        $num = "number=" ascii nocase
        $dnctl = "dnctl" ascii nocase
        $sh = "/bin/sh" ascii
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "`" ascii
        $meta4 = "$(" ascii

    condition:
        $num and (any of ($meta*)) and ($dnctl or $sh)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111218 pfSense Limiter number Field Shell Metacharacter Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"limiter"; nocase; http.client_body; content:"number="; pcre:"/number=[^&]*[;|`$()]/i"; reference:cve,2026-111218; classtype:attempted-admin; sid:2026111218; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "dnctl" and
  process.parent.name in ("php-fpm", "php", "sh") and
  process.command_line : "*number*" and
  process.command_line regex~ "(.*[;&|`$()].*)"

Splunk SPL Query

index=pfsense sourcetype=pfsense:webgui OR sourcetype=pfsense:filterlog
| search (uri="*limiter*" AND form_data="*number=*")
| regex form_data="number=[^&]*[;|`$()]"
| stats count values(form_data) as payload values(src_ip) as source_ip by user, uri, _time
| where count > 0

Wazuh OSSEC Rule

<group name="pfsense,cve-2026-111218,">
  <rule id="2026111" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri">limiter</field>
    <field name="form_data">number=</field>
    <description>CVE-2026-111218: pfSense limiter number field edit - possible OS command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026112" level="14">
    <if_sid>2026111</if_sid>
    <regex>number=[^&amp;]*[;|`$()]</regex>
    <description>CVE-2026-111218: Shell metacharacters detected in pfSense limiter number field - active exploitation</description>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Audit and strictly minimize accounts holding Traffic Shaper Limiters privileges; revoke delegated limiter access from any user who does not require it.
   • Since the injection is triggered via the limiter number field and deletion path, temporarily restrict access to limiter management to a small, trusted administrator set and monitor those accounts closely.
   • Enforce strong authentication (MFA) and network-restrict management access (restrict the web GUI to a dedicated management VLAN or trusted source IPs) to reduce the likelihood an attacker can obtain the required limiter-level privileges.
   • Deploy the detection rules above to alert on shell metacharacters in the limiter number field and on anomalous dnctl child-process spawning.

2. Patch/upgrade steps

   • No vendor patch or fixed version is currently available. Monitor the Netgate pfSense CE release notes and advisories for a version addressing CVE-2026-111218.
   • Until a fix ships, treat all affected installations (2.7.0–2.9.0) as vulnerable and apply the compensating controls above.
   • When a patched release becomes available, stage and validate it, then upgrade promptly given the root-level impact.

3. Long-term hardening

   • Adopt least-privilege delegation models so that limiter-management rights are not broadly granted.
   • Require code review or automated linting that enforces safe subprocess invocation (argument arrays instead of shell string interpolation) for any custom pfSense packages or scripts.
   • Enable centralized logging of the pfSense web GUI and process execution, and forward to a SIEM with the EQL/SPL guidance provided.
   • Maintain asset inventory identifying pfSense instances and their versions to rapidly scope exposure when patches land.

References

• NVD — CVE-2026-111218: https://nvd.nist.gov/vuln/detail/CVE-2026-111218
• Netgate pfSense CE Security Advisories: https://www.netgate.com/security
• pfSense CE Release Notes / Upgrade Guidance: https://docs.netgate.com/pfsense/en/latest/
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No public Proof-of-Concept, exploit code, or Nuclei template is known for this CVE. CVE-2026-111218 is not listed in CISA KEV, and no threat actor campaign or in-the-wild exploitation has been reported as of this writing.