Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111220Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

High 7.2

In plain English

A high-severity security flaw in pfSense CE from Netgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

Affected products (as reported)

Vendor	Product	Versions
Netgate	pfSense CE	0 – through 2.9.0

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/abraxas/pfsense-pppoe-cron exploit, technical-description
https://abraxaslabs.tech/research/pfsense-ce-leftovers technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L2174-L2214 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_ppps_edit.php#L271-L278 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/services.inc#L5652-L5660 technical-description
VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid third-party-advisory