CVE-2026-111216 Netgate CVE debrief

Who should care

System administrators and security teams responsible for Netgate pfSense CE installations, particularly those with gateway edit privileges, should assess exposure and apply patches as available.

Why it matters

Authenticated OS command injection vulnerability in Netgate pfSense CE through 2.9.0 allows users with gateway edit privileges to execute commands as root.

• Authenticated users can inject malicious commands as root.
• Gateway edit privileges can be exploited for OS command injection.
• Input validation and sanitization are necessary to prevent exploitation.
• Patches should be applied as available to prevent exploitation.

Technical summary

The vulnerability allows authenticated users with gateway edit privileges to execute OS commands as root by injecting shell metacharacters into an IPv6 link-local zone index. This can be done by setting a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied. Input validation and sanitization are necessary to prevent exploitation. Patches should be applied as available to prevent exploitation. The vulnerability affects Netgate pfSense CE through 2.9.0.

Defensive priority

Authenticated users with gateway edit privileges can inject shell metacharacters, allowing OS command injection as root.

Recommended defensive actions

• Review and restrict gateway edit privileges for authenticated users.
• Implement input validation and sanitization for IPv6 link-local zone indexes.
• Monitor for suspicious activity and apply patches as available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Apply patches as available to prevent exploitation.

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in Netgate pfSense CE through 2.9.0. The vulnerability allows authenticated users with gateway edit privileges to execute OS commands as root by injecting shell metacharacters into an IPv6 link-local zone index. The source item provides technical description and exploit information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.