pfSense CE EUVD-2026-102341

Exploitation requires three concrete conditions: (1) the attacker must possess the specific 'Captive Portal HA' WebGUI privilege (authenticated, per CVSS PR:H - this is not anonymous access); (2) the Captive Portal high-availability sync feature must be in use so that backwardsyncip and the XMLRPC connected_users exchange are active; and (3) the attacker must be able to point backwardsyncip at an XMLRPC server they control (or otherwise influence the synced connected_users ip/mac fields). The exploitable sink is captiveportal_load_pfctl passing unescaped ip/mac values into a pfctl shell command. Limiting factors: the required Captive Portal HA privilege is a non-default, specifically granted permission; the HA sync deployment mode is not universal; and successful injection depends on the firewall processing attacker-controlled sync data. Affected builds are pfSense CE 2.7.0 through 2.9.0.

This is a credible but privilege-gated priority rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, VC/VI/VA all High, base 8.6) and CWE-78 confirm network-reachable, low-complexity command injection yielding full root compromise of the firewall. However, PR:H is the decisive limiter: exploitation requires an account already holding the Captive Portal HA privilege, so this is fundamentally a privilege-escalation-to-root path for an existing semi-trusted operator, not an anonymous internet attack. Publicly available exploit code exists (POC from VulnCheck/abraxaslabs), which raises operational risk and lowers the barrier to weaponization, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active exploitation - the exploitation signal is 'POC available' only, which must not be conflated with in-the-wild use. Net: high technical impact (root on a perimeter firewall) tempered by a non-default feature requirement and a privileged-account precondition. Treat as a high-priority patch for any pfSense CE deployment that uses Captive Portal HA, and as lower urgency where that feature and privilege are not provisioned.

An attacker who holds the Captive Portal HA privilege on a pfSense CE firewall points the backwardsyncip setting at an XMLRPC server they control. That server returns a connected_users list whose ip or mac fields embed shell metacharacters, which captiveportal_load_pfctl passes unescaped into a pfctl shell command, executing attacker commands as root. A public proof-of-concept exists (github.com/abraxas/pfsense-cp-ha-pfctl), reducing the effort needed to reproduce the attack; CVSS AC:L indicates reliable, low-complexity triggering once the privilege is held.