Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-19 20:43
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-19 20:43
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 8.6NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 7
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://github.com/abraxas/pfsense-assign-if-add Issue Tracking
- https://github.com/abraxas/pfsense-wireless-clone Issue Tracking
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3370 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_assign.php#L187 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_wireless_edit.php#L77 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-wireless-parent-interface Third Party Advisory