Netgate pfSense FRR package: OS command injection in FRR status filter
Summary
The FRR package (pfSense-pkg-frr) for pfSense contains an OS command injection flaw in the FRR status filter. An authenticated WebGUI user who holds only the page-status-frr privilege can craft a filter value that breaks out of a shell expression and runs attacker-chosen commands as root. Only firewalls with the FRR package installed are affected.
Affected
- pfSense-pkg-frr 2.0.2_1
- pfSense-pkg-frr source revision 2.1.2_1
- Other versions: Unknown.
Fixed in
- Updated FRR packages are available for pfSense Plus 26.07 and 26.03.1, and for pfSense CE 2.9.0 and 2.8.1 (according to the CVE record).
- Exact fixed package version: Unknown (to be verified against the vendor advisory).
Workaround
- Unknown. No vendor workaround is documented.
- Remove the FRR package if it is not required.
- Restrict WebGUI access to a management network or VPN.
- Review and remove the page-status-frr privilege from accounts that do not need it.
Exploitation
- CISA SSVC: Exploitation none, Automatable no.
- Not listed in CISA KEV.
- No public proof of concept or confirmed in-the-wild exploitation found at the time of research.
Our recommendation
- Check whether the FRR package is installed on all pfSense units and remove it if it is not needed.
- Check whether the WebGUI is reachable from the internet and restrict it to management networks or VPN.
- Review accounts with the page-status-frr privilege.
- Apply the vendor update as soon as the fixed version is confirmed, and keep pfSense patched in general.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Redmine pfSense advisory #17134 redmine.pfsense.org
- pfSense FRR status_frr.php (GitHub) github.com
- OpenCVE CVE-2026-110908 app.opencve.io
- VulDB CVE-2026-110908 vuldb.com
- VulDB vulnerability 420460 vuldb.com
- Vulners VULNRICHMENT CVE-2026-110908 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:36.
Original description (NVD)
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.