Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
CVE-2026-111217
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111217
pfSense CE
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/pfsense/pfsense",
"vendor": "Netgate",
"product": "pfSense CE",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "2.9.0"
}
],
"packageURL": "pkg:github/pfsense/pfsense",
"collectionURL": "https://github.com",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111217
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #44993 · Revision 1
- Added to Heist Feed
- Publisher date