CVE-2026-111220
CVE-2026-111220 · Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
CVSS 8.6 · Alta · EPSS 0,7%
- Publicación
- Actualización
Productos y versiones afectados
pfsense ce
- Versiones
- ≥ 0, ≤ 2.9.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/abraxas/pfsense-pppoe-cron
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L2174-L2214
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_ppps_edit.php#L271-L278
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/services.inc#L5652-L5660
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-crontab-injection-via-ppp-periodic-reset-ptpid
- https://nvd.nist.gov/vuln/detail/CVE-2026-111220