OS Command Injection Vulnerability in Netgate pfSense by Netgate
CVE-2026-111225

2.3LOW

Key Information:

Vendor

Netgate

Status
Pfsense Ce
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111225?

An OS command injection flaw exists in Netgate pfSense CE versions 2.5.0 through 2.9.0 within the openvpn.learn-address.sh script. This vulnerability can be exploited by authenticated VPN clients, who can inject shell metacharacters into their certificate common name or username. If DNS Resolver client registration is active, these injected commands are improperly processed within unquoted su -c strings, allowing attackers to execute arbitrary commands with the privileges of the unbound user. Security measures should be implemented to mitigate the risk of exploitation.

Affected Version(s)

pfSense CE 2.5.0 <= 2.9.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111225 - Proof of Concept

References

https://github.com/abraxas/pfsense-ovpn-learn-cn
exploittechnical-description
https://abraxaslabs.tech/research/pfsense-ce-leftovers
technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.