Netgate pfSense Community Edition contains an OS command injection flaw triggered by an unvalidated CARP VHID. An authenticated user with Virtual IP edit privileges can supply a VHID string that includes shell metacharacters, which is then passed directly into system interface configuration calls such as interface_ipalias_configure() or get_carp_interface_status(). The flaw is a CWE‑78 type of injection, and a successful exploit allows arbitrary command execution with root privileges, potentially enabling complete system compromise.

The vulnerability affects Netgate pfSense CE releases up to and including version 2.9.0. Any deployment of the Community Edition that permits administrators to edit virtual IP settings is at risk. No specific hardware or OS platform distinctions are noted beyond the software version.

The CVSS score of 8.6 indicates high severity. The EPSS score of 7% indicates a moderate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with Virtual IP edit rights, so the attack vector is likely remote via the web interface. A successful payload injects shell commands that execute as root, enabling an attacker to modify configuration, install persistence mechanisms, or cause denial of service.