CVE-2026-111219
CVE-2026-111219 · Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
CVSS 7.5 · Alta · EPSS 0,9%
- Publicación
- Actualización
Productos y versiones afectados
pfsense ce
- Versiones
- ≥ 0, ≤ 2.9.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/abraxas/pfsense-pppoe-secret-bang
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L272-L282
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_pppoe_edit.php#L141-L152
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-pppoe-server-username
- https://nvd.nist.gov/vuln/detail/CVE-2026-111219