pfSense CE: OS command injection via Traffic Shaper Limiters

Summary

Netgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection in the Traffic Shaper Limiters feature. An authenticated user with the Traffic Shaper Limiters privilege can manipulate the hidden number field of a limiter and then delete it, so that the value is passed unquoted to dnctl via /bin/sh as root. The attack leads to root command execution on the firewall, and a public proof of concept exists.

Affected

• Netgate pfSense CE 2.7.0 through 2.9.0 (range from the CNA record; the 2.7.x range is not verified)
• Default configuration: unaffected
• Tested by the researcher: 2.9.0-DEVELOPMENT, commit 9363ac5b8651a1c7a333180425ce7719070f95f9
• Required privilege: page-firewall-trafficshaper-limiter

Fixed in

Unknown. No vendor advisory or fixed release has been found.

Workaround

• Remove the page-firewall-trafficshaper-limiter privilege from all users who do not need it
• Review the user list in System > User Manager
• Restrict WebGUI access to management networks and enforce strong authentication for admin accounts

Exploitation

• Public proof of concept: yes (researcher repository and write-up, dated 14 Oct 2026)
• Exploited in the wild: no evidence found, not listed in KEV
• CISA SSVC: exploitation poc, automatable no, technical impact total
• EPSS: 8%

Our recommendation

• Check which users hold the Traffic Shaper Limiters privilege and remove it where it is not required
• Check that the WebGUI is not reachable from the internet
• Monitor for unexpected limiter changes and dnctl activity in the logs
• Watch the Netgate security advisories for a fix and update as soon as one is available

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Researcher write-up: pfSense limiter number abraxaslabs.tech
• Researcher repository: pfsense-limiter-number github.com
• pfSense source: shaper.inc (delete_queue) github.com
• Vulners CVE entry vulners.com
• Netgate pfSense traffic shaper documentation docs.netgate.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:02.