Read the docs
TI-2026-74577 Aliases CVE-2026-110908

Netgate pfSense FRR package OS command injection via FRR status filter

Priority MEDIUM 49CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression, where escapeshellarg() output is concatenated. A popen() pipeline then evaluates shell command substitution, which lets the attacker run chosen commands as root. The CVSS 3.1 base score is 8.8 (HIGH), and the weakness is CWE-78.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06084 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetgatepfSense-pkg-frr2.0.2_1; 2.1.2_1—No fix listedCNA
  • pfSense-pkg-frr VendorNetgate Affected 2.0.2_1; 2.1.2_1 Fixed in — No fix listed CNA

Remediation

Install the updated FRR packages for pfSense Plus 26.07 or 26.03.1, or for pfSense CE 2.9.0 or 2.8.1. The sources list no fixed version, so use these releases.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110908
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-15 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2022-13704 pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS… CVSS 3.1CRITICAL 9.8
  • TI-2023-12003 A command injection vulnerability in the function restore_rrddata() of Netgate pfSense… CVSS 3.1HIGH 8.8
  • TI-2024-31010 A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute… CVSS 3.1CRITICAL 9.3
  • TI-2023-11923 Improper restriction of excessive authentication attempts in the SSHGuard component of… CVSS 3.1CRITICAL 9.8
  • TI-2023-26046 An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a… CVSS 3.1HIGH 8.8
  • TI-2023-22567 An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code… CVSS 3.1HIGH 8.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences