pfSense CE CVE-2026-111224

Exploitation requires: (1) a valid VPN account authenticated through a RADIUS or LDAP backend (PR:L - the attacker must control their own username value), and (2) the pfSense OpenVPN server must invoke the openvpn.connect_async.sh connect/disconnect script that eval's the pfctl anchor name. The injection is delivered via a username containing single quotes and shell metacharacters that break out of the eval'd string. Limiting factors that reduce real-world exposure: valid credentials are mandatory (not unauthenticated), the specific OpenVPN connect-script and external-auth (RADIUS/LDAP) configuration must be in use (reflected as AT:P/AC:H), and only pfSense CE through 2.9.0 is affected.

This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) describes a network-reachable flaw requiring low privileges and a present attack requirement, with full confidentiality, integrity and availability impact on the vulnerable system (VC:H/VI:H/VA:H) - consistent with the description's claim of command execution as root. The real escalation value is high because a low-privileged VPN user gains root on the firewall itself. A public exploit exists (abraxas/pfsense-ovpn-connect-eval) and the finding was reported by VulnCheck, which raises practical exploitability above a theoretical issue. Tempering factors: AC:H plus AT:P indicate this is NOT trivially universal - it depends on a specific deployment (OpenVPN using the connect/disconnect script with RADIUS or LDAP auth), and PR:L means the attacker needs valid VPN credentials. No CISA KEV listing and no EPSS score were provided in the input, so there is NO evidence of active in-the-wild exploitation at this time - the POC indicates capability, not observed attacks. Net: real priority for affected configurations (public POC + root impact + exposed VPN endpoints), but not a drop-everything mass-exploitation event absent KEV/EPSS signals.

An attacker with valid but low-privileged VPN credentials (e.g., a legitimate RADIUS/LDAP user, or a compromised account) connects to the pfSense OpenVPN server using a username containing single quotes and shell metacharacters. When openvpn.connect_async.sh eval's the pfctl anchor name on connect or disconnect, the injected payload executes as root. A public proof-of-concept exploit is available, lowering the skill needed to reproduce the attack.