Description
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
Affected products
pfsense: pfsense
References7
- abraxaslabs.tech/research/pfsense-carp-vhid ExploitIssue TrackingMitigation
- abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- github.com/abraxas/pfsense-carp-vhid Third Party Advisory
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce771… Product
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce771… Product
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce771… Product
- www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-o… Third Party Advisory
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
8.6
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 7% percentile: 94 · as of 10 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.