Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://abraxaslabs.tech/research/pfsense-limiter-number Exploit, Issue Tracking, Mitigation
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 15:38
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-20 15:38
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 8.6NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 6
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://abraxaslabs.tech/research/pfsense-limiter-number Exploit, Issue Tracking, Mitigation
- https://github.com/abraxas/pfsense-limiter-number Third Party Advisory
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-traffic-shaper-limiters Third Party Advisory