CVE-2026-111231 — Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_inst…
Published: 2026-10-15 · CVSS: 8.6 · CVSS 4.0
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7