OS Command Injection Vulnerability in Netgate pfSense FRR Package

CVE-2026-110908

What is CVE-2026-110908?

The Netgate pfSense FRR package is susceptible to an OS command injection vulnerability due to insufficient input sanitization in the FRR status filter. An authenticated user, possessing only the page-status-frr privilege, can manipulate a filter value to escape a single-quoted sed expression, resulting in shell command substitution being evaluated through a popen() pipeline. This exploitation allows an attacker to execute arbitrary commands with root privileges. Updated versions of the FRR package have been released to address this issue.

References