CVE-2026-111229
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Description
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- Its current EPSS score (6.4%) is higher than that of 21% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Netgate | Netgate pfSense CE | 2.7.0 to 2.9.0 |
References
5 Links- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/captiveportal.inc#L2958-L2966
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_captiveportal_hasync.php#L106-L140
Record Details
More from Netgate
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.