pfSense FRR EUVD-2026-101816

Exploitation requires (1) the optional pfSense-pkg-frr package to be installed on the firewall, (2) a valid authenticated WebGUI session, and (3) that account to hold the page-status-frr privilege, which is normally a limited status/read role. The specific trigger is the FRR status filter input on the status_frr.php page, where a filter value breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated, enabling shell command substitution evaluated by a popen() pipeline. Limiting factors: this is not exploitable pre-authentication (PR:L), is inapplicable to deployments that have not installed the FRR package, and is confined to users granted the page-status-frr privilege; accounts without that privilege cannot reach the vulnerable code path.

This is a credible, high-priority post-authentication privilege-escalation flaw rather than a low-real-risk high-CVSS artifact, but its exploitability is gated by meaningful preconditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) correctly reflects network-reachable WebGUI exploitation with low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability - consistent with the description's claim of arbitrary command execution as root. The PR:L metric matches the stated requirement for an authenticated WebGUI user holding the page-status-frr privilege, so this is explicitly an authenticated issue, not a pre-auth exploit. No EPSS score, SSVC decision, KEV listing, or public POC is present in the supplied intelligence: there is no public exploit identified at time of analysis, so the risk is latent/potential rather than demonstrated active exploitation. The practical risk driver is the impact asymmetry - a low-privilege, read-only status role escalates directly to root on a firewall - which makes this attractive for post-compromise lateral movement and privilege escalation even though it is not remotely exploitable without credentials. Note the scope: NVD rates S:U despite a jump from a constrained WebGUI privilege to OS root; a case could be made for S:C, so defenders should treat the effective impact as full device takeover regardless of the scope metric.

An attacker who already holds a limited pfSense WebGUI account with the page-status-frr privilege (for example a low-tier operator account, or an account obtained via phishing/credential reuse) opens the FRR status page and submits a crafted filter value. The value breaks out of the single-quoted sed expression that concatenates escapeshellarg() output, and shell command substitution is then evaluated by the popen() pipeline, running attacker-chosen commands as root on the firewall. No public exploit code is identified at time of analysis, but the vulnerable source location is publicly referenced, lowering the barrier to weaponization.