Advisory · CVE-2026-111214
pfSense QinQ interface value can inject shell commands that run as root
An OS command injection flaw in pfSense CE 2.7.0 through 2.9.0 lets a user with QinQ edit privilege store a crafted parent interface name that is later interpolated into ifconfig shell commands, executing as root. The disclosure record rates it CVSS 4.0 8.6 (CVSS 3.1 7.2).
- Vendor
- Netgate
- Product
- pfSense CE
- Identifier / CWE
- CVE-2026-111214
CWE-78 - Action timing
- Immediate
Explain it like I’m five
A field that should only hold an interface name is pasted straight into a shell command, so a crafted name becomes extra commands the firewall runs as root.
- 01Privileged user edits QinQ
An authenticated user with QinQ edit privilege saves a crafted parent interface value.
- 02Value stored unchecked
The unvalidated value is kept in the firewall configuration.
- 03ifconfig command built
Editing the QinQ entry interpolates the stored value into ifconfig shell commands.
- 04Commands run as root
The injected commands execute with root privileges on the firewall.
What happened
Disclosure records published October 15, 2026 describe an OS command injection vulnerability (CWE-78) in Netgate pfSense CE 2.7.0 through 2.9.0. The affected element is QinQ handling: a parent interface name saved without validation is later used inside ifconfig shell commands when the QinQ entry is edited.
The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.
What to do
- Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
- Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
- Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
- Audit the configuration and logs for QinQ entries or parent interface values containing shell metacharacters, and unexpected commands in firewall logs around interface changes.
- Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
- Verify the firewall version or patch state after remediation.
Management note
A firewall’s admin plane is its crown jewels. Any path from a scoped edit privilege to root shell commands should be patched and audited as a full admin compromise candidate.