CVE-2026-111223

Executive Summary

CVE-2026-111223 is a configuration injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0 that allows an authenticated attacker with IPsec Mobile privileges to inject arbitrary configuration directives into strongswan.conf via the login_banner field. By submitting a single-line banner containing a } character, the attacker escapes the unquoted attribute value and defines charon.start-scripts entries that the strongSwan charon daemon executes as root upon restart. Successful exploitation yields full root-level command execution on the firewall appliance, with CVSS 3.1 score 7.2 (High).

Technical Analysis

The vulnerability is an instance of CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection), specifically a configuration-language injection into the strongSwan IKEv2 daemon configuration file (strongswan.conf) generated by pfSense.

pfSense exposes a login_banner field associated with the IPsec Mobile configuration. This value is intended to be a human-readable banner presented to mobile IPsec clients. When pfSense renders the strongswan.conf file, the banner value is written into an attribute without surrounding quotation marks and without escaping special characters. Because strongSwan's configuration parser uses brace-delimited blocks (key { ... }), an attacker who can control the banner value can inject the closing brace } to terminate the intended attribute block prematurely, then append additional configuration directives that are parsed as top-level strongSwan configuration.

The most impactful injected directive is charon.start-scripts, which instructs the charon daemon to execute an external program or script as root when the daemon starts or restarts. Because charon runs with root privileges on the appliance, any script named by the attacker inherits that privilege level.

Key constraints derived from the description:

• The attacker must be authenticated and hold IPsec Mobile privileges. This is the privilege gate (CVSS PR:H).
• The injection occurs through a single-line login_banner value, meaning the payload must be compact and must not rely on multi-line formatting.
• Exploitation requires the charon daemon to restart for the injected start-scripts to be executed; this can be triggered by the attacker or occur naturally through service restarts or appliance reboots.
• No public PoC, exploit code, or Nuclei template is available. The attack chain below is therefore described at the vulnerability-class level; no function names, file paths beyond those in the NVD description, or API endpoints are asserted.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network reachability, low attack complexity, high privileges required, no user interaction, and high confidentiality, integrity, and availability impact, but the scope remains unchanged (the vulnerable component and impacted component are the same appliance).

Exploitation Scenarios

Because no public exploit exists, this chain is inferred strictly from the NVD description and the CWE-74 class.

1. Reconnaissance / Target Identification. The attacker identifies internet- or network-exposed pfSense CE appliances running versions 2.7.0–2.9.0. Targets can be enumerated with Shodan dorks such as product:"pfSense" or by scanning for characteristic pfSense login pages on port 443. The attacker must possess valid credentials with IPsec Mobile configuration privileges — these can be legitimate low-privilege administrator accounts, over-provisioned accounts, or credentials obtained through prior compromise.

2. Triggering the Flaw Class. The attacker authenticates to the pfSense webGUI and navigates to the IPsec Mobile configuration where the login_banner field is editable. Because the field is rendered into strongswan.conf without quoting and without neutralizing special characters, this is a classic configuration injection: the attacker supplies input containing a } character that escapes the intended attribute block. Per the description, the malicious value must be a single line.

3. Payload / Execution Method (class level). The injected content closes the current attribute block with } and then declares charon.start-scripts entries pointing to attacker-controlled commands. Unlike a memory-corruption exploit, no memory layout manipulation is required — the attacker simply writes configuration text that the strongSwan parser later interprets as legitimate directives. The payload executes when charon restarts.

4. Post-Exploitation Impact. On charon restart, the start-scripts command runs as root. This grants the attacker full control of the appliance: reading/modifying firewall rules, exfiltrating configuration and secrets (e.g., VPN keys, user credentials), pivoting into internal network segments that trust the firewall, and establishing persistence via injected scripts or additional firewall services. With C:H/I:H/A:H, the entire confidentiality, integrity, and availability posture of the appliance is compromised.

Impact Assessment

pfSense is widely deployed as an edge firewall, VPN concentrator, and router; compromise of the appliance often constitutes compromise of the network perimeter. Because exploitation yields root command execution, the blast radius extends beyond the appliance itself: every network segment, VPN tunnel, and host that trusts the firewall for access control or traffic inspection is exposed. CVSS subscores reflect high confidentiality (configuration files, VPN pre-shared keys, certificates, and user hashes), high integrity (firewall rules, routing, DNS), and high availability (the attacker can disable the firewall or crash services) impact. Privileges required is High (authenticated IPsec Mobile user), and the scope is Unchanged. CISA KEV status is NO and EPSS is not yet scored by FIRST.org; there is no evidence of in-the-wild exploitation at the time of writing, but the low attack complexity and root-level payoff make this a high-value target for post-compromise privilege escalation and persistence inside environments already using pfSense.

Detection Guidance

Sigma Rule

title: pfSense strongSwan Configuration Injection via IPsec Mobile Login Banner
id: 8f3a2c91-5d47-4b1e-9c2a-7e6f1b0d4a55
status: experimental
description: Detects writes to pfSense login_banner or strongswan.conf containing brace-escape injection and charon.start-scripts directives
author: Threat Intelligence
logsource:
  product: linux
  service: auditd
detection:
  selection_file:
    type: 'PATH'
    name|endswith:
      - '/strongswan.conf'
      - '/ipsec.conf'
  selection_content:
    - 'charon.start-scripts'
    - 'start-scripts'
    - 'login_banner'
  selection_brace:
    data|contains: '}'
  condition: selection_file and (selection_content or selection_brace)
falsepositives:
  - Legitimate administrative edits to strongSwan configuration
level: high
tags:
  - attack.t1190
  - attack.t1543
  - cve.2026.111223

YARA Rule

rule CVE_2026_111223_pfSense_strongswan_injection
{
    meta:
        description = "Detects strongswan.conf injection artifacts containing charon.start-scripts and brace escape from pfSense login_banner"
        author = "Threat Intelligence"
        reference = "CVE-2026-111223"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "charon.start-scripts" ascii wide nocase
        $s2 = "start-scripts" ascii wide nocase
        $s3 = "login_banner" ascii wide nocase
        $brace = "}" ascii

    condition:
        (uint32be(0) != 0x7f454c46) and
        (
            ($s1 and $brace) or
            ($s2 and $brace and $s3)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111223 pfSense strongSwan config injection via login_banner"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"ipsec"; nocase; http.request_body; content:"login_banner"; nocase; http.request_body; content:"}"; http.request_body; content:"start-scripts"; nocase; classtype:attempted-admin; sid:2026111223; rev:1; reference:cve,2026-111223; metadata:created_at 2026_01_01, confidence High;)

Elastic Detection

process where event.type == "start" and process.name in ("charon", "ipsec") and
  process.args : "*start-scripts*" and
  process.parent.name : ("charon", "starter", "swanctl")

Splunk SPL Query

index=firewall OR index=linux sourcetype=syslog
(process=charon OR process=sh OR process=bash)
AND (("charon.start-scripts" OR "start-scripts" OR "/usr/local/etc/strongswan.conf" OR "strongswan.conf"))
AND (charon OR "ipsec restart" OR "config.xml")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process, command
| where count > 0
| sort - firstTime

Wazuh OSSEC Rule

<group name="pfSense,CVE-2026-111223,">
  <rule id="2026111" level="12">
    <decoded_as>syslog</decoded_as>
    <match>charon.start-scripts|start-scripts</match>
    <description>CVE-2026-111223: strongSwan charon.start-scripts directive observed - possible pfSense config injection</description>
  </rule>
  <rule id="2026112" level="10">
    <decoded_as>syslog</decoded_as>
    <match>login_banner</match>
    <regex>.*}.*</regex>
    <description>CVE-2026-111223: Possible login_banner brace injection in pfSense IPsec Mobile configuration</description>
  </rule>
  <rule id="2026113" level="12">
    <if_sid>550</if_sid>
    <field name="file">strongswan.conf</field>
    <description>CVE-2026-111223: Modification of strongswan.conf detected on pfSense appliance</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict and audit accounts holding IPsec Mobile privileges; treat them as privileged accounts. Where feasible, disable remote access to the pfSense webGUI on untrusted interfaces and require management via VPN or a dedicated management VLAN. Review strongswan.conf for unexpected charon.start-scripts or start-scripts directives and for stray } characters originating from banner fields. Because the banner value is single-line, monitor configuration changes for } characters in banner fields. Consider disabling the custom login banner feature until a fix is available, if operationally acceptable.

2. Patch/upgrade steps. No official vendor patch has been published as of this report. Monitor Netgate pfSense CE release notes and the Netgate security advisories page for an update covering versions 2.7.0–2.9.0. When a fixed release is available, upgrade immediately and re-validate strongswan.conf. Until then, treat the appliance as vulnerable and apply compensating controls above.

3. Long-term hardening. Enforce least privilege on administrative roles (avoid granting IPsec Mobile privileges to accounts that do not require them), enable multi-factor authentication for all webGUI access, centralize configuration change logging to a SIEM, and deploy file-integrity monitoring on strongswan.conf and related IPsec configuration files. Establish a routine to reconcile pfSense-managed configuration against expected baselines and to alert on unexpected charon child processes or start-scripts invocations. Monitor for the emergence of patches and upgrade promptly once available.

References

• NVD — CVE-2026-111223: https://nvd.nist.gov/vuln/detail/CVE-2026-111223
• Netgate pfSense CE security advisories: https://www.netgate.com/security
• Netgate pfSense CE releases: https://docs.netgate.com/pfsense/en/latest/releases/index.html
• strongSwan charon configuration documentation: https://docs.strongswan.org/docs/latest/config/charon.html
• CISA KEV catalog (currently not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild exploitation evidence was identified at the time of writing. EPSS has not yet been scored by FIRST.org.