pfSense CE EUVD-2026-102330

Requires an authenticated pfSense CE web GUI account holding the Traffic Shaper Limiters privilege (PR:H). The attacker must edit an existing limiter and submit a crafted hidden 'number' parameter, then delete that limiter so delete_queue() passes the attacker-controlled, unquoted value to dnctl through /bin/sh running as root. Limiting factors: exploitation is gated on prior authenticated access with this specific privilege and on reaching the limiter edit/delete workflow - it is not exploitable against an unauthenticated or unprivileged attacker and no special non-default configuration is required beyond having the Traffic Shaper feature in use.

This is a credible, well-corroborated OS command injection (CWE-78) in pfSense CE 2.7.0-2.9.0, but the real-world risk is moderated by its privilege prerequisite. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) indicates network-reachable, low-complexity exploitation with full confidentiality/integrity/availability impact, but PR:H confirms the attacker must already hold Traffic Shaper Limiters privileges - this is a privilege-escalation/post-authentication issue, not an unauthenticated remote takeover. Publicly available exploit code exists (abraxas/pfsense-limiter-number) and the finding comes from a reputable source (VulnCheck) with source-line references into pfSense's shaper.inc, so the technical validity is high. However, there is NO EPSS score, NO SSVC decision data, and NO CISA KEV listing in the input, so there is no evidence of active exploitation - status is 'publicly available exploit code exists' only. Net: a genuine priority for pfSense operators to patch given a public POC and root-level impact, but the PR:H gate means it is a trusted-but-constrained-user or chained-access risk rather than a mass-exploitable internet-facing threat. Do not treat the 8.6 score as equivalent to an unauthenticated RCE.

An authenticated user (or a compromised lower-trust admin account) granted Traffic Shaper Limiters access edits a limiter and injects a malicious hidden 'number' field value, then deletes the limiter so delete_queue() passes the unquoted value into dnctl executed via /bin/sh as root. A public proof-of-concept exists, and because the web GUI is network-reachable (AV:N) with low complexity, the operation is reliable once the attacker holds the required privilege.