pfSense CE CVE-2026-111223

Exploitation requires an authenticated pfSense CE account (version 2.7.0-2.9.0) with IPsec Mobile configuration privileges and the ability to set the mobile-client login banner (vpn_ipsec_mobile.php login_banner field). The specific trigger is a single-line banner value containing a '}' character that escapes the unquoted strongswan.conf 'attr' value (attr id 28672) and injects charon.start-scripts entries. Code execution as root does not occur on submission alone - it fires when the strongSwan/charon daemon is restarted (e.g., IPsec configuration apply or service reload), so a charon restart is a required precondition. Limiting factors: PR:H high-privilege access to IPsec Mobile settings is mandatory, the IPsec mobile feature must be in use, and no unprivileged or unauthenticated path exists; there is no mitigating user-interaction requirement (UI:N).

This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with a score of 8.6 and full VC:H/VI:H/VA:H impact reflects that successful exploitation yields command execution as root - the highest possible technical impact - over the network with low complexity and no user interaction. The decisive limiting signal is PR:H: the attacker must already hold IPsec Mobile configuration privileges, so this is a privilege-escalation / post-authentication root-compromise primitive, not an unauthenticated internet-facing breach. Supporting signals strengthen the priority: a POC exploit is publicly available (publicly available exploit code exists) and a vendor patch exists, the root cause is confirmed by the referenced pfSense commit diff, and the research is credited to VulnCheck. No EPSS score was supplied, and the vulnerability is NOT listed in CISA KEV (no KEV data in input), so there is no evidence of active exploitation - treat the public POC as elevating likelihood but distinct from confirmed in-the-wild use. Net: a real priority for defenders who delegate IPsec Mobile administration or cannot fully trust those operators, and for any multi-tenant/managed-firewall scenario, but lower urgency than an unauthenticated RCE given the PR:H barrier.

An authenticated pfSense user who holds IPsec Mobile configuration privileges sets the mobile-client login banner to a single-line value containing a '}' character, which escapes the unquoted strongswan.conf attr value and injects a charon.start-scripts entry. When the IPsec/charon daemon is restarted (e.g., on the next configuration apply or service reload), strongSwan executes the attacker-defined script as root, giving full control of the firewall. A public POC exists at the referenced abraxaslabs/GitHub research, and the low attack complexity (AC:L, no user interaction) makes reliable exploitation straightforward once the required privilege is held.