---
id: CVE-2026-111214
title: >-
  Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection
  vulnerability that allows authenticated users with QinQ edit privilege to run
  commands by storing an unvalidated parent interface name
summary: >-
  Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection
  vulnerability that allows authenticated users with QinQ edit privilege to run
  commands by storing an unvalidated parent interface name. Attackers can save a
  crafted …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Netgate
product: pfSense CE
affected:
  - pfsense_ce >= 2.7.0 <= 2.9.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:33.603'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111214'
references:
  - url: 'https://abraxaslabs.tech/research/pfsense-ce-leftovers'
    label: disclosure@vulncheck.com
  - url: 'https://abraxaslabs.tech/research/pfsense-qinq-parent-if'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/abraxas/pfsense-qinq-parent-if'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L620
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L136
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L212
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-interfaces-qinq-edit-php
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-15T19:25:46.426Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T16:29:12.622142Z'
epss: 0.10826
epssPercentile: 0.95826
---

## Overview

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.