Netgate pfSense CE: Command injection in Captive Portal HA sync
Summary
pfSense CE versions 2.7.0 through 2.9.0 contain a command injection flaw in the Captive Portal HA sync page. A user who holds only the Captive Portal HA privilege can set the backwards sync IP to a malicious XMLRPC server, whose returned connected_users data is passed unescaped into a pfctl shell command. This allows execution of commands as root. Exploitation requires an account with that privilege, and the default configuration is not affected.
Affected
- pfSense CE 2.7.0 to 2.9.0 (per CNA record)
- Default configuration: unaffected
- Requires the Captive Portal HA privilege (page-services-captiveportal-hasync)
Fixed in
Unknown. No vendor fix version was found at the time of research.
Workaround
- Remove the Captive Portal HA privilege from accounts that do not need it.
- Disable Captive Portal HA sync if it is not in use.
- Restrict WebGUI access to management networks. Not vendor-validated.
Exploitation
- CISA SSVC: exploitation status 'poc', not automatable.
- A public proof-of-concept lab by the researcher exists on GitHub.
- One aggregator reports active exploitation; this is not verified. VulDB reports no available exploit.
- Not checked against the CISA KEV catalogue.
Our recommendation
- Check which users hold the Captive Portal HA privilege under System > User Manager and remove it where not needed.
- Disable Captive Portal HA sync if unused.
- Restrict WebGUI access to admin networks and review administrative logins.
- Monitor Netgate Security Advisories and apply the fixed release as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync (VulnCheck) www.vulncheck.com
- pfSense CE leftovers, part 1 (Abraxas Labs) abraxaslabs.tech
- pfsense-cp-ha-pfctl lab repository (GitHub) github.com
- captiveportal.inc at commit 9363ac5 (pfSense GitHub) github.com
- services_captiveportal_hasync.php at commit 9363ac5 (pfSense GitHub) github.com
- CVE-2026-111229 record (Vulners) vulners.com
- CVE-2026-111229 (VulDB) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:00.
Original description (NVD)
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
NVD references (5)
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-cp-ha-pfctl
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/captiveportal.in…
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_c…
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-captive-por…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.