Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 15:37
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-20 15:37
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 7.5NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 6
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://github.com/abraxas/pfsense-l2tp-radius-mpd Third Party Advisory
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L202-L215 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L428-L441 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_l2tp.php#L137-L143 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-radius-secret-mpd-conf-injection Third Party Advisory