Description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Published: 2026-10-15
Score: 8.6 High
EPSS: 8.0% Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Pfsense
Pfsense pfsense
CPEs cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
Vendors & Products Pfsense
Pfsense pfsense

Thu, 15 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Title Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
First Time appeared Netgate
Netgate pfsense
Weaknesses CWE-78
CPEs cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*
Vendors & Products Netgate
Netgate pfsense
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Netgate Pfsense
Pfsense Pfsense
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T20:07:51.202Z

Reserved: 2026-10-15T18:21:18.816Z

Link: CVE-2026-111218

cve-icon Vulnrichment

Updated: 2026-10-15T20:06:47.272Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T19:17:34.210

Modified: 2026-10-20T15:38:34.380

Link: CVE-2026-111218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T20:00:08Z

Weaknesses