pfSense CE CVE-2026-111216

Requires an authenticated pfSense CE web-GUI account that holds gateway edit privileges (PR:H). The attacker must configure a gateway Monitor IP using an IPv6 link-local address and embed shell metacharacters in that address's zone index field, which the application does not validate; the payload executes only when gateway monitoring is applied and start_dpinger() builds the dpinger command string. Limiting factors: this is strictly post-authentication and privilege-gated - a low-privileged or unauthenticated user cannot reach the vulnerable gateway-edit path - and affects pfSense CE versions through 2.9.0. No end-user interaction beyond the attacker's own configuration action is needed (UI:N).

This is a genuine but access-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) shows a network-reachable, low-complexity attack with full VC:H/VI:H/VA:H impact, consistent with the description's claim of arbitrary command execution as root. The decisive limiter is PR:H: exploitation requires an authenticated account already holding gateway edit privileges, so this is a privilege-escalation-to-root / post-authentication issue rather than a pre-auth internet-facing worm candidate. Publicly available exploit code exists (abraxaslabs PoC referenced) and the research is corroborated by VulnCheck, which raises practical risk; however, there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at this time - the signal is 'exploit code available, exploitation unconfirmed.' Net: treat as high-priority patching for any pfSense CE deployment where firewall/gateway administration is delegated to non-fully-trusted operators, but the required high privilege level means a fully-trusted single-admin appliance faces lower real-world risk.

An authenticated pfSense operator (or an attacker who has phished/compromised such an account) with gateway edit rights navigates to the gateway configuration, sets a Monitor IP as an IPv6 link-local address, and appends shell metacharacters to the zone index. When monitoring is applied, start_dpinger() concatenates the unescaped zone into the dpinger shell command, executing the attacker's payload as root. A public proof-of-concept exploit for this chain is available.