CVE-2026-111231

Executive Summary

CVE-2026-111231 is an authorization bypass vulnerability in Netgate pfSense CE through version 2.9.0, tracked as CWE-863 (Incorrect Authorization). The flaw allows an authenticated, low-privileged WebGUI user (read-only) to replace the system's config.xml via config_restore() and config_install(), which ignore the "User - Config: Deny Config Write" privilege, ultimately enabling root-level code execution after reload or reboot. The CVSS v3.1 base score is 7.2 (High), reflecting a network-adjacent attack vector requiring high privileges but resulting in complete confidentiality, integrity, and availability loss.

Technical Analysis

pfSense CE is an open-source firewall and router distribution based on FreeBSD, widely deployed at network perimeters as an edge firewall, VPN concentrator, and routing appliance. The WebGUI provides administrative management of all system functions, including configuration backup, restore, and installation. Access to these functions is governed by a role-based privilege system where individual administrative users can be granted granular permissions.

The vulnerability lies in improper authorization enforcement. The config_restore() and config_install() functions do not check the "User - Config: Deny Config Write" privilege, effectively ignoring the intended restriction on configuration write operations. As a result, a user who holds page-level privileges for any of the following endpoints — services_acb.php (Auto Configuration Backup), uploadconfig.php (configuration upload), diag_confbak.php (configuration backup history), or diag_backup.php (backup/restore interface) — can invoke configuration restore/install functionality that should have been denied.

Because config.xml defines the complete system configuration, an attacker who can replace it can set arbitrary directives, including those that cause the execution of attacker-controlled commands or scripts on the underlying FreeBSD host. The NVD description explicitly states that installing a chosen config.xml can gain "root-level code execution after reload or reboot." The exact mechanism by which config.xml yields root-level execution after reload is not detailed in the provided description; however, pfSense config.xml supports system-level initialization directives and shell hooks that run with high privilege during boot, which is the class of mechanism the vulnerability description references.

Key technical attributes:

• CWE: CWE-863 — Incorrect Authorization. The application performs authentication correctly but fails to enforce the required privilege check for a sensitive operation.
• Attack Vector: Network (AV:N) — WebGUI is reachable over the network.
• Attack Complexity: Low (AC:L) — the operation is a standard configuration restore/install.
• Privileges Required: High (PR:H) — the attacker must already be an authenticated WebGUI user with page privileges on at least one of the listed endpoints.
• User Interaction: None (UI:N) — no victim action is required once the attacker has the privileges.
• Scope: Unchanged (S:U) — impact remains within the pfSense appliance/OS boundary.
• Confidentiality/Integrity/Availability: High/High/High (C:H/I:H/A:H) — full compromise of the system, up to root-level code execution.

The attack surface is the pfSense WebGUI's configuration management endpoints. The vulnerability is not dependent on any external service; it is rooted in the application's own privilege enforcement logic.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-111231. The attack chain below is inferred strictly from the NVD description and the vulnerability class (CWE-863, Incorrect Authorization). No specific function names, endpoints, or parameters beyond those in the NVD description are fabricated.

1. Reconnaissance / Target Identification The attacker identifies internet- or LAN-exposed pfSense CE appliances running version 2.9.0 or earlier. This may be done through Shodan searches (e.g., title:"pfSense"), network scanning for the pfSense WebGUI login page, or during an internal engagement. The attacker must already possess credentials for a WebGUI user that holds page privileges on services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. Such accounts may be read-only administrative accounts, delegated operator accounts, or non-admin users with limited page access.

2. Triggering the Specific Flaw (Incorrect Authorization) After authenticating to the WebGUI, the attacker navigates to one of the permitted configuration pages (e.g., diag_backup.php). The application allows the attacker to invoke the configuration restore/install functionality (config_restore() and config_install()) because those functions do not enforce the "User - Config: Deny Config Write" privilege. In a correctly authorized system, the read-only user's lack of config-write privilege would block the operation. The attacker bypasses this by interacting directly with the restore/install action exposed through the permitted page.

3. Payload / Execution Method (Vulnerability-Class Level) The attacker supplies a crafted config.xml file to the restore/install functionality. Because config.xml controls all system configuration, the attacker can define directives that result in root-level command execution upon system reload or reboot. The NVD description states this explicitly: "install a chosen config.xml to gain root-level code execution after reload or reboot." The attacker then triggers a reload or waits for a reboot to activate the malicious configuration.

4. Post-Exploitation Impact Successful exploitation yields root-level code execution on the FreeBSD host underlying pfSense CE. This grants the attacker full control of the firewall appliance: the ability to read and modify network traffic, disable firewall rules, exfiltrate configuration data (including credentials and VPN keys), pivot into internal networks, and establish persistence. Given pfSense's typical role at the network edge, compromise can affect the entire protected network segment.

Impact Assessment

CVE-2026-111231 has a CVSS v3.1 base score of 7.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (C:H): An attacker with root-level access can read all system data, including configuration files, credentials, VPN pre-shared keys, certificates, and network traffic traversing the appliance.
• Integrity (I:H): The attacker can arbitrarily modify config.xml and system state, altering firewall rules, routing, VPN configurations, and installed packages.
• Availability (A:H): The attacker can disrupt or disable network services, cause denial of service, or render the appliance unstable.
• Privileges Required (PR:H): Exploitation requires an authenticated WebGUI account with page privileges on at least one of the named configuration endpoints. This reduces the attack surface to insider threats, compromised low-privileged accounts, or attackers who have already obtained valid credentials.
• Attack Complexity (AC:L): No specialized conditions or race conditions are required; the operation is a normal configuration restore/install.
• Scope (S:U): The impact is confined to the vulnerable pfSense appliance and its underlying OS.

Business impact: pfSense CE is widely deployed as an edge firewall and VPN gateway. A compromised appliance can expose the entire internal network to lateral movement, enable persistent adversary access, and violate network segmentation controls. Organizations relying on pfSense for compliance-mandated boundary protection face regulatory and data-breach risk. Because the attacker must first hold valid WebGUI credentials, the vulnerability is most dangerous in environments with delegated administrative accounts, shared credentials, or unmonitored read-only users.

Blast radius: Every pfSense CE instance through 2.9.0 that grants any user page privileges on services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php is potentially affected. Internet-exposed WebGUI instances raise the risk if credentials are weak or reused.

Detection Guidance

Sigma Rule

title: Potential pfSense CE Config Restore Authorization Bypass (CVE-2026-111231)
id: 8f3b2c1a-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects access to pfSense configuration restore/install pages by users who may lack config-write privilege, indicative of CVE-2026-111231 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111231
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  product: webserver
  service: http
detection:
  selection_pages:
    cs-uri-stem:
      - '/services_acb.php'
      - '/uploadconfig.php'
      - '/diag_confbak.php'
      - '/diag_backup.php'
  selection_methods:
    cs-method:
      - 'POST'
  condition: selection_pages and selection_methods
falsepositives:
  - Legitimate administrative configuration backup or restore by fully privileged users
level: medium
tags:
  - attack.t1078
  - cve.2026.111231

YARA Rule

rule CVE_2026_111231_pfSense_Config_Restore_Abuse
{
    meta:
        description = "Detects references to pfSense config restore/install endpoints associated with CVE-2026-111231"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111231"
        cve = "CVE-2026-111231"

    strings:
        $a = "config_restore" ascii nocase
        $b = "config_install" ascii nocase
        $c = "services_acb.php" ascii nocase
        $d = "uploadconfig.php" ascii nocase
        $e = "diag_confbak.php" ascii nocase
        $f = "diag_backup.php" ascii nocase
        $g = "config.xml" ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x7F454C46) and
        (2 of ($a, $b) or 1 of ($c, $d, $e, $f)) and $g
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111231 pfSense CE Config Restore Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"diag_backup.php"; http.uri; content:"uploadconfig.php"; http.uri; content:"diag_confbak.php"; http.uri; content:"services_acb.php"; fast_pattern; http.request_body; content:"config.xml"; nocase; reference:cve,2026-111231; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-111231; classtype:attempted-admin; sid:2026111231; rev:1;)

Elastic Detection

sequence by host.hostname, user.name with maxspan=5m
  [ network where event.category == "network" and url.path in ("/services_acb.php", "/uploadconfig.php", "/diag_confbak.php", "/diag_backup.php") and http.request.method == "POST" ]
  [ file where event.category == "file" and file.name == "config.xml" and event.action in ("creation", "modification") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=pan:traffic
| eval uri=lower(uri_path)
| where uri IN ("/services_acb.php","/uploadconfig.php","/diag_confbak.php","/diag_backup.php")
| where http_method="POST"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,pfsense,cve-2026-111231,">
  <rule id="202611231" level="10">
    <if_sid>31100</if_sid>
    <id>^GET|^POST</id>
    <url>/services_acb.php|/uploadconfig.php|/diag_confbak.php|/diag_backup.php</url>
    <description>CVE-2026-111231: Possible pfSense CE configuration restore/install authorization bypass attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>pfsense_config_restore,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

   • Remove excessive privileges: Audit all WebGUI users and revoke page privileges on services_acb.php, uploadconfig.php, diag_confbak.php, and diag_backup.php from any account that should not have configuration write capability. Since the flaw is an authorization bypass, the most direct mitigation is to ensure no untrusted account holds those page privileges at all.
   • Restrict WebGUI exposure: Do not expose the pfSense WebGUI to the internet. Restrict access to a dedicated management VLAN or VPN, and enforce firewall rules limiting source IPs.
   • Enforce MFA and strong credentials: Reduce the likelihood of an attacker obtaining a valid low-privileged WebGUI session. Monitor for credential stuffing or brute-force attempts against the WebGUI.
   • Monitor configuration changes: Forward pfSense configuration change logs to a SIEM and alert on unexpected config.xml restores/installs or reboots.
   • Least privilege: Convert any read-only or delegated operator accounts to the minimum page permissions required; avoid shared administrative accounts.

2. Patch / Upgrade Steps

   • No vendor patch is currently identified by tracked sources. Monitor Netgate's official pfSense CE release notes, security advisories, and the NVD entry for CVE-2026-111231 for an updated version.
   • Once a fixed release is available, upgrade pfSense CE to the patched version. Back up the current config.xml and validate the appliance after upgrade.
   • Apply the vendor's recommended privilege model changes if documented in the advisory.

3. Long-Term Hardening

   • Implement role-based access control with regular privilege reviews for all WebGUI users.
   • Deploy network segmentation so that compromise of the firewall appliance does not immediately expose all internal segments.
   • Enable configuration backup integrity verification and baseline config.xml hashes to detect unauthorized modifications.
   • Maintain an inventory of pfSense CE versions and subscribe to Netgate security announcements.
   • Consider defense-in-depth controls (e.g., authenticated reverse proxy, IP allowlisting) for management interfaces.

References

• NVD entry for CVE-2026-111231: https://nvd.nist.gov/vuln/detail/CVE-2026-111231
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Netgate pfSense CE official documentation and security advisories: https://www.netgate.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-111231 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence is currently available for CVE-2026-111231. No threat actor campaigns have been publicly associated with this CVE.