pfSense CE EUVD-2026-102326

Exploitation requires an authenticated pfSense web interface account that holds the QinQ edit privilege (per CVSS PR:H), plus network reachability to the management UI. The specific feature is QinQ VLAN interface editing (interfaces_qinq_edit.php): the attacker stores an unvalidated parent interface 'if' value, then re-edits the QinQ entry so that value is interpolated into an ifconfig shell command, achieving code execution as root. No end-user interaction is needed (UI:N). The principal limiting factor is the privilege requirement - this is a post-authentication flaw usable only by operators already trusted with interface configuration - and risk is further bounded where the pfSense management interface is not exposed to untrusted networks or lower-trust users.

This is a genuine but access-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, base 8.6) is consistent with the description: network-reachable web UI, low complexity, but PR:H because the attacker must already hold QinQ edit privilege in pfSense - i.e. an authenticated administrative-tier account. Technical impact is total (code execution as root, full C/I/A loss), and SC/SI/SA:N correctly reflect no cross-system scope change. A public POC exists (VulnCheck advisory plus a GitHub exploit repo), which raises practical risk, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score provided in the input, so widespread opportunistic exploitation cannot be asserted. The key tension is the PR:H gate - because exploitation presupposes an already-privileged web user, this is primarily a privilege-to-root escalation / post-authentication RCE rather than a pre-auth internet worm. Prioritize patching for any pfSense exposing its management interface to untrusted users or where lower-trust operators hold interface-edit rights; de-prioritize relative to pre-auth critical firewall bugs. EPSS and KEV data are both absent/negative, so real-world exploitation volume is unknown.

An authenticated pfSense operator holding QinQ edit privilege saves a QinQ entry with a malicious parent interface ('if') value containing shell metacharacters, then edits the entry so the stored value is interpolated into an ifconfig command. When the command runs, the injected payload executes as root, giving full control of the firewall. A public proof-of-concept is available (abraxaslabs / GitHub), lowering the skill required to reproduce the attack.