pfSense CE: OS command injection via gateway Monitor IP
Summary
Netgate pfSense CE up to and including 2.9.0 contains an OS command injection in the gateway monitoring code. An authenticated user with gateway edit rights can inject shell metacharacters through an IPv6 link-local zone index in the Monitor IP and run commands as root. Exploitation requires a WebGUI session with gateway edit privileges and the change being applied, which in most small firms means the main admin account.
Affected
- Netgate pfSense CE up to and including 2.9.0
- Tested build: 2.9.0-DEVELOPMENT (9363ac5)
- pfSense Plus: unknown
Fixed in
Unknown. No fixed release or vendor advisory was found at the time of writing.
Workaround
- No vendor workaround found.
- Limit gateway edit privileges to named administrators and review delegated privileges.
- Restrict WebGUI access to a management VLAN or VPN.
- Check gateway Monitor IP entries for unexpected IPv6 zone-ID text.
Exploitation
- Public proof of concept published by the researchers (Abraxas Labs), verified in a lab.
- CISA SSVC: exploitation 'poc', not automatable.
- No evidence of exploitation in the wild.
- EPSS about 4.7 percent.
Our recommendation
- Update pfSense CE as soon as Netgate publishes a fixed release.
- Until then, restrict WebGUI access and limit gateway edit rights to trusted admins.
- Check admin accounts for reused or weak credentials and enable MFA where available.
- Check gateway Monitor IP settings for unexpected characters.
- Watch the Netgate security advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Researcher repository (Abraxas Labs) github.com
- Researcher write-up (Abraxas Labs) abraxaslabs.tech
- pfSense gwlb.inc at 9363ac5 github.com
- pfSense util.inc at 9363ac5 github.com
- Vulners CVE record vulners.com
- HOL Guard CVE summary hol.org
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:05.
Original description (NVD)
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
NVD references (5)
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-gw-ipv6-zone
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/gwlb.inc#L535
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/util.inc#L1418
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-gateway-monito…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.