Description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Affected products
pfsense: pfsense
References6
- abraxaslabs.tech/research/pfsense-limiter-number ExploitIssue TrackingMitigation
- abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- github.com/abraxas/pfsense-limiter-number Third Party Advisory
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce771… Product
- github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce771… Product
- www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2… Third Party Advisory
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
8.6
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 9% percentile: 95 · as of 10 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.