Pfsense Pkg Frr
Monthly
OS command injection in the pfSense-pkg-frr package (2.0.2_1 and source revision 2.1.2_1) lets an authenticated WebGUI user holding only the low-privilege page-status-frr role execute arbitrary commands as root on the firewall. The flaw sits in the FRR status filter on status_frr.php, where a crafted filter value escapes a single-quoted sed expression that concatenates escapeshellarg() output before being evaluated through a popen() pipeline. Exploitation requires the optional FRR package to be installed plus a valid authenticated session with the page-status-frr privilege (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8), so it is a post-authentication privilege escalation rather than a pre-auth compromise; there is no public exploit identified at time of analysis, and no CISA KEV listing. Updated FRR packages resolve the issue for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
OS command injection in the pfSense-pkg-frr package (2.0.2_1 and source revision 2.1.2_1) lets an authenticated WebGUI user holding only the low-privilege page-status-frr role execute arbitrary commands as root on the firewall. The flaw sits in the FRR status filter on status_frr.php, where a crafted filter value escapes a single-quoted sed expression that concatenates escapeshellarg() output before being evaluated through a popen() pipeline. Exploitation requires the optional FRR package to be installed plus a valid authenticated session with the page-status-frr privilege (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8), so it is a post-authentication privilege escalation rather than a pre-auth compromise; there is no public exploit identified at time of analysis, and no CISA KEV listing. Updated FRR packages resolve the issue for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.