Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
References
Configurations
History
19 Oct 2026, 20:43
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pfsense
Pfsense pfsense |
|
| References | () https://abraxaslabs.tech/research/pfsense-ce-leftovers - Issue Tracking | |
| References | () https://abraxaslabs.tech/research/pfsense-ipsec-login-banner - Exploit, Issue Tracking | |
| References | () https://github.com/abraxas/pfsense-ipsec-login-banner - Mitigation, Third Party Advisory | |
| References | () https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1361-L1388 - Product | |
| References | () https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/ipsec.inc#L1842-L1845 - Product | |
| References | () https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_ipsec_mobile.php#L269-L273 - Product | |
| References | () https://github.com/pfsense/pfsense/commit/27a52d0807 - Patch | |
| References | () https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-command-injection-via-ipsec-mobile-login-banner - Third Party Advisory | |
| CPE | cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:* |
15 Oct 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-15 19:17
Updated : 2026-10-19 20:43
NVD link : CVE-2026-111223
Mitre link : CVE-2026-111223
CVE.ORG link : CVE-2026-111223
JSON object : View
Products Affected
pfsense
- pfsense
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')