CVE-2026-111220: Netgate pfSense CE: Crontab injection via PPP periodic reset

Summary

pfSense CE through 2.9.0 contains a crontab injection flaw in the PPP interface edit page (interfaces_ppps_edit.php). An authenticated user with the 'WebCfg - Interfaces: PPPs: Edit' privilege can inject newlines into the ptpid or reset hour/minute fields, which are written unescaped into /etc/crontab. Injected commands then run as root on the configured schedule, giving full control of the firewall.

Affected

pfSense CE through 2.9.0
Only systems that use PPP/PPPoE interfaces with the periodic reset option are relevant
pfSense Plus is not named in the CVE description

Fixed in

Unknown. No vendor advisory or fixed CE build has been confirmed.

Workaround

Limit the 'WebCfg - Interfaces: PPPs: Edit' privilege to trusted administrators
Disable the PPP periodic reset feature if it is not needed
Restrict access to the web GUI to a management network
Review /etc/crontab for unexpected entries

Exploitation

Public exploit code: a GitHub repository tagged as exploit-related exists; its content was not reviewed
CISA SSVC: exploitation status poc, not automatable
Known exploitation in the wild: not found
EPSS: 0.00726

Our recommendation

Check whether PPP/PPPoE periodic reset is configured and who holds the PPP edit privilege
Restrict the web GUI to trusted management networks and remove unnecessary privileges
Review /etc/crontab for unexpected entries
Update to the latest pfSense CE release once Netgate's fix is confirmed, and monitor Netgate's security advisories
Prioritise internet-exposed or multi-admin firewalls

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Abraxas Labs research: pfSense CE leftovers abraxaslabs.tech
VulnCheck advisory: pfSense CE crontab injection via PPP periodic reset www.vulncheck.com
GitHub: pfsense-pppoe-cron (public repository) github.com
pfSense source: interfaces_ppps_edit.php github.com
pfSense source: interfaces.inc github.com
VulDB entry for CVE-2026-111220 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:02.

Original description (NVD)

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed