Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111215Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

High 7.2

In plain English

A high-severity OS command injection in pfSense CE from Netgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)6.2%top 6.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

Affected products (as reported)

Vendor	Product	Versions
Netgate	pfSense CE	0 – through 2.9.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/abraxas/pfsense-wireless-clone exploit, technical-description
https://abraxaslabs.tech/research/pfsense-ce-leftovers technical-description
https://github.com/abraxas/pfsense-assign-if-add exploit, technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3370 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_wireless_edit.php#L77 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_assign.php#L187 technical-description
VulnCheck Advisory: Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface third-party-advisory