CVE-2026-111231

Name of the Vulnerable Software and Affected Versions Netgate pfSense CE versions prior to 2.9.0

Description An authorization bypass exists that allows read-only WebGUI users to replace the config.xml file. This occurs because the config restore() and config install() functions ignore the User - Config: Deny Config Write privilege. Attackers with page privileges for the endpoints 'services acb.php', 'uploadconfig.php', 'diag confbak.php', or 'diag backup.php' can install a custom config.xml to achieve root-level code execution following a reload or reboot.

Recommendations Update Netgate pfSense CE to version 2.9.0 or later. Restrict access to the endpoints 'services acb.php', 'uploadconfig.php', 'diag confbak.php', and 'diag backup.php' for users with read-only privileges.