CVE-2026-111220 Netgate CVE debrief

Who should care

System administrators and security teams responsible for pfSense CE deployments, especially those with version 2.9.0 or earlier, should assess exposure and implement necessary mitigations.

Why it matters

CVE-2026-111220 is a high-severity vulnerability in Netgate pfSense CE through version 2.9.0, allowing authenticated users to inject crontab entries and execute commands as root. Defenders should prioritize verifying exposure, restricting privileges, and monitoring for suspicious activity.

• Potential for authenticated users to execute arbitrary commands as root
• Possible disruption of system operations through crontab injection
• Need for verification of pfSense CE version and exposure
• Requirement for restricting 'WebCfg - Interfaces: PPPs: Edit' privileges

Technical summary

The vulnerability exists in interfaces_ppps_edit.php of pfSense CE through 2.9.0. Authenticated users with 'WebCfg - Interfaces: PPPs: Edit' privilege can inject newlines into ptpid or reset hour/minute fields, allowing them to execute commands as root via configured_cron() writing unescaped into /etc/crontab. This issue allows potential for arbitrary command execution with root privileges, impacting system integrity and confidentiality. Defenders should prioritize verifying exposure, restricting privileges, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying exposure of pfSense CE versions up to 2.9.0, reviewing and restricting 'WebCfg - Interfaces: PPPs: Edit' privileges, and monitoring for suspicious crontab changes.

Recommended defensive actions

• Verify pfSense CE version and exposure
• Restrict 'WebCfg - Interfaces: PPPs: Edit' privileges
• Monitor for suspicious crontab changes
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability. However, information on exploitation, impact, and remediation is limited. Defenders should verify exposure by checking pfSense CE versions up to 2.9.0, review 'WebCfg - Interfaces: PPPs: Edit' privileges, and monitor for suspicious crontab changes. Evidence from the CVE Program and NVD detail page supports this assessment. Additional review of supplemental sources may provide further insight into affected scope and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.