CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- Its current EPSS score (8.4%) is higher than that of 24% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Netgate | Netgate pfSense CE | 2.7.0 to 2.9.0 |
References
6 Links- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-limiter-number
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821
Record Details
More from Netgate
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.