Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111221Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection

Medium 6.6

In plain English

A medium-severity security flaw in pfSense CE from Netgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.9%top 38.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.

Affected products (as reported)

Vendor	Product	Versions
Netgate	pfSense CE	0 – through 2.9.0

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/abraxas/pfsense-l2tp-radius-mpd exploit, technical-description
https://abraxaslabs.tech/research/pfsense-ce-leftovers technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L428-L441 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L202-L215 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_l2tp.php#L137-L143 technical-description
VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection third-party-advisory