High priorityDisclosed

Advisory · CVE-2026-111216

pfSense gateway monitor IP zone value can inject commands into dpinger as root

An OS command injection flaw in pfSense CE through 2.9.0 lets a user with gateway edit privilege place shell metacharacters in an IPv6 link-local zone index, which is passed unescaped into the dpinger monitoring command and runs as root. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).

Advisory published October 15, 2026Independent summary
Vendor
Netgate
Product
pfSense CE
Identifier / CWE
CVE-2026-111216
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

The zone part of a gateway address is treated as trusted text and glued into a shell command, so a malicious zone stops being an address and becomes instructions.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Privileged user edits a gateway

    An authenticated user with gateway edit privilege sets a Monitor IP with a crafted IPv6 zone index.

  2. 02Zone stored unchecked

    The unvalidated zone value is saved with the gateway configuration.

  3. 03Monitoring applies it

    When monitoring is applied, the start_dpinger path passes the zone unescaped into a shell command.

  4. 04Commands run as root

    The injected payload executes with root privileges.

What happened

Disclosure records published October 15, 2026 describe an OS command injection vulnerability (CWE-78) in Netgate pfSense CE through 2.9.0. A gateway Monitor IP whose IPv6 link-local zone index contains shell metacharacters is passed unescaped to the dpinger shell command when gateway monitoring is applied.

The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.

What to do

  1. Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
  2. Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
  3. Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
  4. Audit the configuration and logs for gateway Monitor IP values containing shell metacharacters and dpinger restarts tied to gateway edits.
  5. Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
  6. Verify the firewall version or patch state after remediation.

Management note

Gateway monitoring touches every routed network the firewall serves. Keep gateway edit rights tight and treat unexpected dpinger behaviour as a security event, not a quirk.