Description
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Published: 2026-10-15
Score: 8.8 High
EPSS: 6.1% Low
KEV: No
Impact: Remote Code Execution via WebGUI
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection flaw in the Netgate pfSense FRR status filter. An authenticated WebGUI user who only holds the page-status-frr privilege can supply a specially crafted filter value that escapes a single‑quoted sed expression. Because the escaped shell argument output is concatenated into the expression, the injected payload is passed to popen() and executed by the shell with root privileges. The attacker can run arbitrary commands at system level, compromising confidentiality, integrity, and availability.

Affected Systems

Netgate’s pfSense FRR package (pfSense-pkg-frr) versions 2.0.2_1 and source revision 2.1.2_1 are vulnerable. Updated FRR packages for pfSense Plus 26.07, 26.03.1 and Community Edition 2.9.0/2.8.1 contain the fix.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity impact. EPSS data is not available, so the exploitation likelihood cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with the page-status-frr privilege, which represents a low barrier for internal users. The required conditions are simple: submit a crafted filter string via the web interface, leading to command execution as root.

Generated by OpenCVE AI on October 15, 2026 at 12:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the updated pfSense FRR package available for pfSense Plus 26.07, 26.03.1 or Community Edition 2.9.0, 2.8.1, which contains the command injection fix.
  • Restrict the page-status-frr privilege to trusted administrators only, ensuring that only authorized users can access the vulnerable filter page.
  • Audit user privileges and revoke the page-status-frr privilege from any non‑admin accounts that should not have access to the FRR status page.

Generated by OpenCVE AI on October 15, 2026 at 12:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Netgate
Netgate pfsense-pkg-frr
Vendors & Products Netgate
Netgate pfsense-pkg-frr

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Netgate pfSense FRR Status Filter

Thu, 15 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Description Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Netgate Pfsense-pkg-frr
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-15T15:43:35.834Z

Reserved: 2026-10-15T02:24:03.804Z

Link: CVE-2026-110908

cve-icon Vulnrichment

Updated: 2026-10-15T15:43:28.153Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T03:17:10.797

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-110908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:37:36Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')