Netgate pfSense CE: OS command injection in QinQ interface editor

Summary

Netgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection in the QinQ interface editor (interfaces_qinq_edit.php). An authenticated user with the QinQ edit privilege can store an unvalidated parent interface name and then trigger it in ifconfig shell commands. Successful exploitation executes commands as root on the firewall, which exposes its configuration, keys and connected networks.

Affected

• Netgate pfSense CE 2.7.0 through 2.9.0 (per CNA record)
• Requires a WebGUI account with the page-interfaces-qinq-edit privilege
• The default admin account holds this privilege

Fixed in

Unknown. No vendor advisory or fixed release was confirmed at the time of research.

Workaround

• Restrict the QinQ edit privilege to highly trusted administrators only
• Restrict WebGUI access to management networks or a VPN
• Review administrative logs for QinQ edits
• Code-level fix proposed by the researcher: reject parent interfaces that are not live interfaces, as the VLAN editor already does

Exploitation

• Public proof-of-concept available (researcher repository)
• CISA SSVC: exploitation status 'poc', not automatable
• No known exploitation in the wild
• CISA KEV status not verified

Our recommendation

• Limit QinQ edit and admin rights to a minimal set of trusted accounts
• Do not expose the pfSense WebGUI to the internet
• Check your pfSense CE version and whether the QinQ editor is in use
• Review admin logs for unexpected QinQ changes
• Apply the vendor fix as soon as Netgate releases one and monitor Netgate security advisories

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection www.vulncheck.com
• Abraxas Labs write-up: pfSense QinQ parent-if abraxaslabs.tech
• Abraxas Labs research: pfSense CE leftovers abraxaslabs.tech
• pfSense source: interfaces_qinq_edit.php (line 136) github.com
• pfSense source: interfaces_qinq_edit.php (line 212) github.com
• pfSense source: interfaces.inc (line 620) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:04.