Netgate pfSense CE: Command injection via IPsec Mobile login banner
Summary
pfSense CE versions 2.7.0 through 2.9.0 contain a configuration injection flaw in the IPsec Mobile login banner, which is written unquoted into the strongSwan configuration. An authenticated user with the IPsec Mobile WebGUI privilege can craft a banner that injects charon start-scripts, which are executed as root when IPsec restarts. The attack requires no unauthenticated access, but it leads to full root command execution on the firewall.
Affected
- Netgate pfSense CE 2.7.0 through 2.9.0 (default configuration unaffected)
- Lab build tested: 2.9.0-DEVELOPMENT (commit 9363ac5)
- Attacker requires the page-vpn-ipsec-mobile WebGUI privilege
Fixed in
Unknown. The referenced fix commit 27a52d0807 has not been verified, and no Netgate advisory or fixed release was identified.
Workaround
- No vendor-issued workaround identified.
- Remove the IPsec Mobile page privilege from users who do not need it.
- Review existing IPsec Mobile login banner values for unexpected content.
- Restrict WebGUI access to a management network.
Exploitation
- Authentication required (WebGUI account with IPsec Mobile privilege).
- A public proof of concept exists from the researcher Abraxas Labs; lab-validated.
- No in-the-wild exploitation found.
- Not listed in CISA KEV per one aggregator.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Review which accounts hold the IPsec Mobile privilege and remove it where not required.
- Audit IPsec Mobile login banner values.
- Restrict WebGUI access to trusted management networks.
- Monitor Netgate advisories and apply the fixed release as soon as it is published.
- Priority: medium for typical setups; raise it if IPsec Mobile is used, admin rights are delegated, or the WebGUI is exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official CVE record: VulnCheck advisory www.vulncheck.com
- Abraxas Labs write-up abraxaslabs.tech
- Abraxas Labs repository github.com
- pfSense commit 27a52d0807 (referenced fix, unverified) github.com
- pfSense ipsec.inc at referenced commit github.com
- Netgate PHP security update www.netgate.com
- OpenCVE CVE-2026-111223 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:03.
Original description (NVD)
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
NVD references (8)
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://abraxaslabs.tech/research/pfsense-ipsec-login-banner
- https://github.com/abraxas/pfsense-ipsec-login-banner
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-…
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-…
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_…
- https://github.com/pfsense/pfsense/commit/27a52d0807
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobil…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.