CVE-2026-111215 — Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless paren…
Published: 2026-10-15 · CVSS: 8.6 · CVSS 4.0
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7