Netgate pfSense CE: OS command injection via wireless parent interface name

Summary

Netgate pfSense CE through version 2.9.0 contains an OS command injection vulnerability in the wireless interface handling. An authenticated user with limited Wireless Edit or Interface Assignments privileges can submit a crafted parent interface name, which is passed unescaped into an ifconfig shell command. Successful exploitation allows commands to run as root on the firewall, giving full control of the device.

Affected

• Netgate pfSense CE through 2.9.0 (CVE description; Plus edition not stated)
• Vulnerable code: interface_wireless_clone(), reached via interfaces_wireless_edit.php and interfaces_assign.php

Fixed in

Unknown. No vendor advisory or fixed version found. Do not assume any CE 2.9.x build is patched.

Workaround

• Restrict web GUI access to a management network or trusted IP addresses
• Remove Wireless Edit and Interface Assignments privileges from users who do not need them
• Disable wireless interfaces if they are not in use
• Audit existing wireless interface names for shell metacharacters

Exploitation

• Requires valid authentication with specific delegated privileges (CVSS PR:H)
• Public PoC status unclear: VulDB states no exploit exists; two GitHub repositories are listed as references but have not been reviewed
• CISA SSVC: exploitation PoC, not automatable
• No evidence of exploitation in the wild found; CISA KEV status not checked

Our recommendation

• Restrict GUI access to management networks and check whether the GUI is reachable from the internet
• Review accounts and remove unnecessary Wireless and Interface Assignment privileges
• Monitor for vendor advisories and apply the fixed release as soon as Netgate publishes one
• Plan to patch together with the sibling issue CVE-2026-111214 (QinQ interface editing)
• Review administrator accounts and monitor for unexpected interface configuration changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Abraxas Labs research: pfSense CE leftovers abraxaslabs.tech
• GitHub: abraxas/pfsense-wireless-clone github.com
• GitHub: abraxas/pfsense-assign-if-add github.com
• pfSense source: interfaces_wireless_edit.php github.com
• pfSense source: interfaces_assign.php github.com
• VulDB entry 420842 vuldb.com
• Vulners CVE-2026-111215 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:04.