Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111214Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
High 7.2
In plain English
A high-severity OS command injection in pfSense CE from Netgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.8% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)10.8%top 4.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netgate | pfSense CE | 2.7.0 – through 2.9.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/abraxas/pfsense-qinq-parent-if exploit, technical-description
- https://abraxaslabs.tech/research/pfsense-ce-leftovers technical-description
- https://abraxaslabs.tech/research/pfsense-qinq-parent-if technical-description
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L136 technical-description
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L212 technical-description
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L620 technical-description
- VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php third-party-advisory