pfSense CE CVE-2026-111227

Requires an authenticated pfSense webConfigurator account holding the specific 'DNS Resolver: Access Lists' privilege, and the Unbound DNS Resolver with access-list functionality in use. Exploitation is performed by placing raw CR/LF characters into the aclname or aclaction fields, which are written unsanitized to access_lists.conf and interpreted as additional Unbound directives. Limiting factors: this is not remote-unauthenticated - it demands a privileged, trusted role (effectively administrative over DNS configuration), so realistic risk is insider misuse or a compromised privileged session rather than opportunistic external attack; no end-user interaction is required once that privilege is held.

This is a genuine but bounded-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scoring 5.1 (Medium) tells the real story: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold the pfSense 'DNS Resolver: Access Lists' privilege, which is an administrative-tier grant on a firewall. Impact is limited to integrity and availability of DNS (VI:L/VA:L on the vulnerable system, SI:L/SA:L on downstream LAN clients) with no confidentiality loss (VC:N). Signals partially conflict: a public exploit exists (VulnCheck-reported POC on GitHub), which raises practical exploitability, yet there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or active exploitation - the POC availability and the lack of KEV together point to a known, demonstrable technique that is not (yet) being exploited at scale. The dominant risk driver is insider/privilege-escalation abuse: a user who already has ACL access can escalate from managing access lists to arbitrary Unbound directive injection, effectively poisoning DNS for the network. Net: real and worth patching on a normal cycle, but not a drop-everything issue given the high-privilege precondition.

An authenticated pfSense operator (or an attacker who has phished/compromised an account) holding the 'DNS Resolver: Access Lists' privilege edits a DNS Resolver access list and embeds CR/LF characters in the ACL name or action field. These characters break out of the intended line in access_lists.conf and inject attacker-chosen Unbound directives (local-data, local-zone, forward-zone), silently redirecting or fabricating DNS answers for all LAN clients. A public proof-of-concept for this technique is available (GitHub, reported by VulnCheck), lowering the effort to reproduce.