pfSense CE CVE-2026-111226

Requires an authenticated pfSense CE WebGUI session belonging to a user with the 'Advanced Admin Access' privilege (an administrative role), and access to the Login Protection / sshguard settings on an affected version (CE 2.4.5 through 2.9.0). The specific exploitable inputs are the sshguard threshold, block time, or detection time fields, which accept newline or $(...) command-substitution content that is written unvalidated to sshguard.conf and sourced as root when the service restarts. Primary limiting factor: the PR:H requirement means only already-privileged admin accounts can trigger it, so non-admin WebGUI users and unauthenticated attackers cannot exploit it directly; the service-restart step is the execution trigger. No end-user interaction is required beyond the attacker's own actions.

This is a genuine but privilege-gated root-code-execution flaw rather than a mass-exploitable remote threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 (High), and the key limiting signal is PR:H - exploitation requires an authenticated WebGUI account already holding the 'Advanced Admin Access' privilege, which is effectively an administrative role. The real value delivered is horizontal/vertical escalation: an admin-level WebGUI user converts their access into arbitrary command execution as root on the underlying firewall OS. A public exploit exists (abraxas/pfsense-sshguard-crlf) and the issue was reported by VulnCheck, so weaponization effort is low once an attacker has valid high-privileged credentials. No CISA KEV listing is present in the input, so there is no evidence of active in-the-wild exploitation, and no EPSS score was provided, so statistical exploitation probability cannot be stated - treat both as MISSING rather than low. Net priority: elevated for internet-exposed or multi-admin pfSense deployments (because root compromise of a perimeter firewall is high-impact), but materially constrained by the PR:H precondition, so this is not a 'patch-in-an-hour-against-anonymous-attackers' scenario. The AV:N network vector is consistent with the WebGUI being reachable over the network; it does not imply unauthenticated access.

An attacker with (or who has phished/compromised) a pfSense WebGUI account carrying Advanced Admin Access privilege navigates to the Login Protection settings and enters an sshguard threshold, block-time, or detection-time value embedded with a newline and a $(...) command substitution. The malicious value is written unvalidated into sshguard.conf and executed as root when the service restarts, yielding full root command execution on the firewall. A public proof-of-concept (abraxas/pfsense-sshguard-crlf) is available, lowering the barrier to reliable exploitation.