CVE-2026-111219
CVE-2026-111219 · Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
CVSS 7.5 · High · EPSS 0.9%
- Published
- Updated
Affected products and versions
pfsense ce
- Versions
- ≥ 0, ≤ 2.9.0: Affected (semver)
No fix published
Original sources
- https://github.com/abraxas/pfsense-pppoe-secret-bang
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L272-L282
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_pppoe_edit.php#L141-L152
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-pppoe-server-username
- https://nvd.nist.gov/vuln/detail/CVE-2026-111219