pfSense CE CVE-2026-111217

Requires an authenticated pfSense CE account possessing Virtual IP (CARP) edit privileges - the attacker must be able to create or modify a CARP VIP and control its VHID field. Exploitation triggers when the stored VHID (containing shell metacharacters) reaches interface_ipalias_configure() ifconfig invocation or get_carp_interface_status() during CARP status rendering, at which point code runs as root. Limiting factors: the PR:H requirement means no anonymous/unauthenticated path; affects pfSense CE builds through 2.9.0; the VIP-edit privilege is typically held only by administrators or explicitly delegated operators, narrowing the realistic attacker population to insiders or those who have already obtained privileged UI access.

This is a credible but privilege-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) describes network-reachable, low-complexity exploitation that yields full compromise, but PR:H is the decisive limiter: an attacker must already hold an authenticated account with Virtual IP (CARP) edit privileges in the pfSense web UI before the OS command injection via an unvalidated CARP VHID can be reached. A public POC exists (abraxas/pfsense-carp-vhid, corroborated by a VulnCheck advisory), which raises practical risk, but there is no CISA KEV listing and no EPSS or SSVC data supplied in the input, so exploitation probability and automatability cannot be quantified from the provided signals. POC availability is NOT the same as active exploitation. Net: treat as a high-value privilege-escalation-to-root issue for any pfSense CE instance where VIP-edit access is delegated to semi-trusted operators, rather than a mass-exploitable unauthenticated flaw - the PR:H requirement makes widespread opportunistic exploitation unlikely. Note: EPSS, KEV, and SSVC inputs are absent, so the real-world exploitation likelihood is unverified from available data.

An authenticated pfSense CE user (or a compromised lower-tier admin account) who has Virtual IP edit rights creates or edits a CARP VIP and sets the VHID field to a value containing shell metacharacters. When interface_ipalias_configure() runs ifconfig, or when CARP status is rendered via get_carp_interface_status(), the injected command executes as root, giving full firewall takeover. A public proof-of-concept for this exact CARP VHID vector is available.