pfSense CE EUVD-2026-102327

Requires an authenticated pfSense CE web GUI account holding the limited 'Wireless Edit' or 'Interface Assignments' privilege; exploitation is performed by injecting shell metacharacters into the wireless parent interface name field submitted to interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() passes unescaped to ifconfig. Affects pfSense CE through 2.9.0. Limiting factors: valid credentials with one of those two specific GUI privileges are mandatory (no anonymous/unauthenticated path), and reaching the management interface typically requires network access to the firewall's web administration port, which is often restricted to internal/management networks in hardened deployments.

This is a credible, actionable priority rather than a paper-tiger high-CVSS issue, but its real-world blast radius is gated by a privilege prerequisite. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 and reflects network-reachable, low-complexity exploitation with full confidentiality/integrity/availability impact, consistent with CWE-78 command injection yielding root. The critical caveat is PR: the description characterizes the needed access as 'limited Wireless Edit or Interface Assignments privileges,' which is a restricted, non-administrative GUI role - so this is fundamentally a privilege-escalation-to-root primitive for an already-authenticated low-privilege user, not an unauthenticated remote takeover. Publicly available exploit code exists (two GitHub repositories plus a VulnCheck advisory), which materially raises the odds of opportunistic use against exposed or multi-tenant management interfaces. No EPSS score was supplied and there is no CISA KEV listing, so there is no evidence of active in-the-wild exploitation at time of analysis - the signals indicate proven exploitability and available tooling, not confirmed mass exploitation. Note a minor tension: the input uses PR:H while the description emphasizes 'limited' privileges, suggesting PR:L is the more honest metric - verify the exact role requirement against the VulnCheck advisory.

An attacker who already holds a limited pfSense GUI account (or compromises one) with Wireless Edit or Interface Assignments rights opens interfaces_wireless_edit.php or interfaces_assign.php and sets the wireless parent interface to a value such as 'ath0;id', which interface_wireless_clone() concatenates unescaped into an ifconfig shell command executed as root. The result is arbitrary command execution as root on the firewall, giving full control of the perimeter device. Publicly available proof-of-concept exploit code exists, lowering the barrier to weaponizing this.