pfSense CE CVE-2026-111220

Exploitation requires an authenticated pfSense CE web-UI session whose user holds the 'WebCfg - Interfaces: PPPs: Edit' privilege; with that access the attacker injects newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php, which configure_cron() writes unescaped into /etc/crontab. Limiting factors: no unauthenticated path exists (PR:H), the attacker must specifically possess the PPPs:Edit WebCfg permission rather than mere login, and the affected versions are pfSense CE up to and including 2.9.0; no special user interaction or non-default product feature beyond normal PPP/cron configuration is needed.

This is a credentialed privilege-escalation-to-root flaw, not a pre-auth mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 largely because the technical impact is total - arbitrary command execution as root - but the PR:H metric is the dominant real-world limiter: the attacker must already be authenticated to the pfSense web UI AND hold the specific 'WebCfg - Interfaces: PPPs: Edit' privilege. Publicly available exploit code exists (GitHub, via VulnCheck), which raises operational urgency, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread or automated exploitation at this time - treat POC availability and active exploitation as distinct signals. The net picture is a high-severity, reliable post-authentication root escalation that matters most where lower-trust operators are granted granular WebCfg privileges or where web-UI credentials can be phished/reused; it is a genuine priority for defense-in-depth on firewall appliances but is gated behind meaningful privilege, so it is not an internet-wide drive-by risk. No key signals conflict with the description; the main missing data are EPSS and any vendor fix/version confirmation beyond 'through 2.9.0'.

An authenticated pfSense operator (or an attacker who has captured such web-UI credentials) who holds the 'WebCfg - Interfaces: PPPs: Edit' privilege submits a crafted POST to interfaces_ppps_edit.php, embedding newline characters in the ptpid or reset hour/minute fields. configure_cron() writes the unescaped values into /etc/crontab, so the injected line runs an arbitrary command as root on the next schedule tick, yielding full firewall compromise. A public exploit for this exact chain is available on GitHub.