Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://abraxaslabs.tech/research/pfsense-carp-vhid Exploit, Issue Tracking, Mitigation
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 15:38
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-20 15:38
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 8.6NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 7
- https://abraxaslabs.tech/research/pfsense-carp-vhid Exploit, Issue Tracking, Mitigation
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://github.com/abraxas/pfsense-carp-vhid Third Party Advisory
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid Third Party Advisory