pfSense CE CVE-2026-111231

Exploitation requires an authenticated WebGUI account that holds page privileges for at least one of services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php - these are the exact pages whose config_restore()/config_install() calls fail to honor the 'User - Config: Deny Config Write' privilege. The account can otherwise be read-only, so the limiting factors are (1) possession of a valid WebGUI login, (2) assignment of one of those specific page privileges, and (3) the exploit only takes full effect after a configuration reload or reboot, meaning root code execution is not instantaneous. No end-user interaction beyond the attacker's own upload is needed, and the attack is reachable over the network against the management interface.

This is a credible, actionable priority rather than an inflated high-CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) rates 8.6 and describes a network-reachable, low-complexity attack with high confidentiality, integrity, and availability impact - consistent with the description's outcome of root-level code execution. The one tempering signal is PR:H (privileges required), meaning this is NOT an unauthenticated exploit: the attacker must already hold a WebGUI account with specific page privileges, so it is primarily a privilege-escalation/authorization-bypass path from a limited (read-only) operator to full root. Public exploit code exists (GitHub PoC plus a VulnCheck advisory and direct links to the vulnerable config.lib.inc source), which raises real-world exploitability for anyone who already has a foothold account. There is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active mass exploitation - this should be read as a high-value post-authentication escalation on a security appliance, not a wormable internet-wide threat. Note a nuance to verify: the input vector uses PR:H, but the description characterizes the attacker as a 'read-only' user holding page privileges, which reads closer to a low-privilege account (PR:L) - this discrepancy slightly raises real-world risk versus the stated PR:H and should be confirmed against the specific privilege model.

A low-privilege pfSense WebGUI operator who has been granted page access to backup/restore functions (e.g. diag_backup.php or services_acb.php) uploads a maliciously crafted config.xml; because config_restore()/config_install() ignore the 'Deny Config Write' privilege, the file is installed despite the account being read-only. After the next reload or reboot the attacker-controlled configuration executes with root privileges, yielding full firewall compromise. Public exploit code for this authorization bypass is already available.