pfSense CE CVE-2026-111228

Exploitation requires an authenticated pfSense CE account (versions 2.7.1 through 2.9.0) that has been granted the 'DNS Resolver: Advanced' privilege, which exposes the services_unbound_advanced.php page. The attacker embeds CR/LF characters in the sock_queue_timeout parameter, which is written unvalidated into unbound.conf, allowing injection of arbitrary Unbound directives. Limiting factors: the high-privilege requirement (the DNS Resolver Advanced role is an administrative function, so this is not exploitable by unauthenticated or low-privileged users), restriction to the 2.7.1-2.9.0 version range, and reachability of the web management interface. No end-user interaction is needed once the attacker holds the privilege.

This is a medium-severity issue (CVSS 4.0 base 5.1) that is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) shows network reach with low complexity but requires high privileges (PR:H) - the attacker must already hold the 'DNS Resolver: Advanced' privilege in the pfSense web UI, which materially limits the attacker population to trusted/admin-adjacent operators. Impact is partial integrity and availability (VI:L/VA:L) with subsequent-system integrity/availability impact (SI:L/SA:L) because poisoned unbound.conf directives affect all downstream DNS clients; confidentiality is rated N. Publicly available exploit code exists (POC from the researcher's GitHub), which raises practical exploitability, but this is distinct from active exploitation: the input shows NO CISA KEV listing and NO EPSS score, so there is no evidence of in-the-wild or widespread automated exploitation. EPSS is missing rather than low, so probability-of-exploitation cannot be quantified from the data - this should be verified. Net: a privilege-gated DNS-tampering flaw with public POC in a widely deployed firewall; prioritize patching where low-privileged accounts hold the DNS Resolver Advanced role, but it does not warrant emergency treatment absent KEV/EPSS signals.

An authenticated pfSense user who holds the 'DNS Resolver: Advanced' privilege submits the services_unbound_advanced.php form with CR/LF characters embedded in the sock_queue_timeout field. Because the value is written raw into unbound.conf, the attacker injects arbitrary Unbound directives that override local DNS records and forwarding rules for every client served by the resolver. A public proof-of-concept exists, lowering the effort required to reproduce the attack.