CVE-2026-111223
CVE-2026-111223 · Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
CVSS 8.6 · Alta · EPSS 0,8%
- Publicación
- Actualización
Productos y versiones afectados
pfsense ce
- Versiones
- ≥ 2.7.0, ≤ 2.9.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/abraxas/pfsense-ipsec-login-banner
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-ipsec-login-banner
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-L1388
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-L1845
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_mobile.php#L269-L273
- https://github.com/pfsense/pfsense/commit/27a52d0807
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobile-login-banner
- https://nvd.nist.gov/vuln/detail/CVE-2026-111223