Netgate pfSense CE: OS command injection via Login Protection settings

Summary

pfSense CE versions 2.4.5 through 2.9.0 contain an OS command injection in the Login Protection (sshguard) settings of the Advanced Admin page. An authenticated WebGUI user with Advanced Admin privileges can submit sshguard threshold, block time or detection time values containing newlines or shell syntax, which are written unvalidated to sshguard.conf and executed as root on restart. A compromised admin account can therefore lead to full control of the firewall.

Affected

• Netgate pfSense CE 2.4.5 through 2.9.0 (per CNA VulnCheck)
• Default configuration is not affected according to the CNA record
• Requires WebGUI access with the page-system-advanced-admin privilege

Fixed in

Unknown. No vendor advisory or fixed release was found. Do not assume a version is patched; check the Netgate security advisories and release notes.

Workaround

• Restrict WebGUI access to a management VLAN or VPN and remove it from WAN
• Limit Advanced Admin rights to trusted accounts and enforce MFA or strong passwords
• Review Login Protection values (threshold, block time, detection time) for unexpected newlines or shell-like content
• Monitor sshguard.conf for unexpected changes

Exploitation

• CISA SSVC: exploitation status poc, automatable no, technical impact total
• No evidence of active exploitation found
• Public PoC status unconfirmed; VulDB reports no exploit available
• CISA KEV listing: not confirmed in the sources; recheck directly

Our recommendation

• Check whether the pfSense WebGUI is reachable from the internet and restrict it to internal or VPN access
• Verify that admin accounts use MFA and strong passwords and that Advanced Admin rights are limited
• Review Login Protection settings and sshguard.conf for anomalies
• Watch for the vendor advisory and apply the fixed release as soon as it is published

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• pfSense syslog.inc at commit 9363ac5 github.com
• pfSense system_advanced_admin.inc at commit 9363ac5 github.com
• Tenable CVE entry www.tenable.com
• VulDB entry vuldb.com
• Feedly CVE entry feedly.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:58.