VulnSocial

CVE-2026-111214

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-16: 110-16
Referenced assets1 URL
Full discourse1 post
  • ThreatAft@ThreatAft

    🔥 pfSense CE: 7 CVEs, peak CVSS 7.5 6 command injection flaws — QinQ, OpenVPN, gateway, Virtual IP, Advanced Admin, Captive Portal — all escalate to root from narrow privileges. CVE-2026-111231: read-only WebGUI users can replace config.xml https://threataft.com/articles/pfsense-ce-cluster-cve-2026-111214-111224-111216-111217-111226-111229-111231

    0000148
    51 followersView on X

Explore more

Back to dashboard