PT-2026-115181 · Netgate · Pfsense Ce

Abraxas Labs

·

CVE-2026-111216

·

Publicado

2026-10-15

·

Atualizado

2026-10-15

CVSS v3.1

7.2

Alta

VetorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

Exploit

Correção

OS Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-111216

Produtos afetados

Pfsense Ce