CVE-2026-111215
CVE-2026-111215 · Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
CVSS 8.6 · Hoch · EPSS 6,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
pfsense ce
- Softwareversionen
- ≥ 0, ≤ 2.9.0: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/abraxas/pfsense-wireless-clone
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-assign-if-add
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3370
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_wireless_edit.php#L77
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_assign.php#L187
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-wireless-parent-interface
- https://nvd.nist.gov/vuln/detail/CVE-2026-111215