{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pfsense-ce-2.7.0-through-2.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netgate:pfsense:2.7.0:*:*:*:*:*:*:*","cpe:2.3:a:netgate:pfsense:2.9.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111214"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pfSense CE (2.7.0 through 2.9.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Netgate"],"content_html":"\u003cp\u003eNetgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection vulnerability within the QinQ interface configuration module. The vulnerability exists due to improper validation of the parent interface name field when editing a QinQ entry. An authenticated attacker with sufficient privileges (QinQ edit access) can provide a crafted input string that is improperly sanitized and subsequently passed to the underlying ifconfig shell command. When the system processes the interface configuration, the injected command is executed with root privileges, leading to full system compromise. This issue highlights the risks associated with improper input handling in network appliance management interfaces.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to elevate their access level to root on the affected pfSense firewall, enabling full control over the network device, data interception, and persistence mechanisms. This affects all installations of pfSense CE versions 2.7.0 through 2.9.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the update of all affected pfSense CE installations to a version beyond 2.9.0 once the vendor releases a patch. As an immediate mitigation, review administrative access logs and restrict the 'QinQ edit' privilege to only highly trusted and necessary accounts to minimize the potential attack surface.\u003c/p\u003e\n","date_modified":"2026-10-15T20:40:37Z","date_published":"2026-10-15T20:40:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pfsense-cmd-injection/","summary":"Authenticated users with QinQ edit privileges can leverage an OS command injection vulnerability in Netgate pfSense CE 2.7.0 through 2.9.0 to execute arbitrary commands as root.","title":"OS Command Injection in Netgate pfSense CE QinQ Interface Configuration","url":"https://feed.craftedsignal.io/briefs/2026-10-pfsense-cmd-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - PfSense CE (2.7.0 Through 2.9.0)","version":"https://jsonfeed.org/version/1.1"}