Dashboard / CVE-2026-111221

CVE-2026-111221

HIGH
MEDIUM Priority: 0.07 BB Relevance: 50/100
Published: 2026-10-15 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
AT: Present
VC: High
VI: High
VA: High

Description

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
pfsense pfsense < 2.9.0

References & Advisories (6)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

7.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.94%
Raw Score 0.009390
Percentile 60.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00939
2026-10-28
0.00939

Intelligence Sources

mitre ref →
nvd ref →

External Links