CVE-2026-111223
CVE-2026-111223 · Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
CVSS 8.6 · High · EPSS 0.8%
- Published
- Updated
Affected products and versions
pfsense ce
- Versions
- ≥ 2.7.0, ≤ 2.9.0: Affected (semver)
No fix published
Original sources
- https://github.com/abraxas/pfsense-ipsec-login-banner
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-ipsec-login-banner
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-L1388
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-L1845
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_mobile.php#L269-L273
- https://github.com/pfsense/pfsense/commit/27a52d0807
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobile-login-banner
- https://nvd.nist.gov/vuln/detail/CVE-2026-111223