pfSense CE CVE-2026-111225

Exploitation requires three specific conditions drawn from the description: (1) the attacker must be able to authenticate as an OpenVPN client, i.e. possess a valid certificate or credentials accepted by the server; (2) the 'DNS Resolver (unbound) client registration' feature must be enabled, which is a non-default configuration; and (3) the attacker must control the certificate common name or the username so shell metacharacters can be injected into the unquoted 'su -c' string in openvpn.learn-address.sh. Limiting factors that reduce realistic risk: valid VPN authentication is mandatory (PR:L), the non-default client-registration setting must be active, attack complexity is high (AC:H) with a present attack requirement (AT:P), the vulnerability exists only in pfSense CE 2.5.0 through 2.9.0, and resulting command execution is confined to the low-privilege 'unbound' user rather than root.

This is a genuine but low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/VC:L/VI:L/VA:L) yields a base score of only 2.3: although the attack is network-reachable, it requires an authenticated VPN client (PR:L), carries high attack complexity (AC:H) plus a present attack requirement (AT:P), and the technical impact is low across confidentiality, integrity, and availability because injected commands run as the limited 'unbound' user rather than root. Publicly available exploit code exists (GitHub PoC plus a VulnCheck advisory), which raises the practical likelihood of opportunistic use, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation - treat the PoC as a capability signal, not confirmation of active exploitation. Net assessment: a real, PoC-backed flaw whose preconditions (valid VPN credentials, a non-default DNS Resolver client-registration setting, and attacker-controlled certificate CN/username) and low-privilege execution context keep real-world risk modest and targeted; it is most meaningful as a potential link in a privilege-escalation chain rather than as a standalone high-impact bug.

An attacker who already holds valid OpenVPN client credentials on a pfSense CE instance (2.5.0-2.9.0) with DNS Resolver client registration enabled connects using a certificate common name or username containing shell metacharacters. When the openvpn.learn-address.sh script interpolates that value unquoted into an 'su -c' string, the embedded commands execute as the unbound user. Public exploit code for this technique is available, though the high complexity and required authentication limit casual mass exploitation.