CVE-2026-110908 Netgate CVE debrief

Who should care

System administrators and security teams with Netgate pfSense FRR package installations, especially those with exposed WebGUI and page-status-frr access, should prioritize verification and application of security updates. Additionally, operators responsible for network security and vulnerability management should be aware of the potential risks and take necessary precautions to mitigate the threat.

Why it matters

CVE-2026-110908 is a high-severity OS command injection vulnerability in Netgate pfSense FRR package. Authenticated users with limited WebGUI privileges can inject commands as root, posing significant risks to network operations and security.

• Potential for authenticated command injection as root.
• Elevation of privileges from page-status-frr access.
• Possible disruption of network operations.
• Need for verification and timely application of security updates.

Technical summary

The FRR status filter in Netgate pfSense FRR package (pfSense-pkg-frr) versions 2.0.2_1 and 2.1.2_1 is vulnerable to OS command injection. An authenticated WebGUI user with page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression, allowing attacker-selected commands to execute as root. This vulnerability results from inadequate input validation and sanitization in the FRR status filter, which enables attackers to inject malicious commands. The vulnerability can be exploited through specially crafted input, potentially leading to unauthorized command execution.

Defensive priority

High priority for systems with exposed WebGUI and page-status-frr access; verify and apply updates.

Recommended defensive actions

• Verify and apply FRR package updates for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
• Restrict WebGUI access to page-status-frr privilege.
• Monitor for suspicious activity on affected systems.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Official CVE Program record and NVD vulnerability detail provide information on the vulnerability. Supplemental sources include Redmine issue 17134 and GitHub code snippet, which offer additional context on the vulnerability. However, the exact scope of affected systems and potential impact on network operations remains limited by available source information. Defenders should verify FRR package versions and WebGUI access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.