CVE-2026-111230 — Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// cust…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7