Description
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local File Read
Action: Apply Patch
AI Analysis

Impact

Netgate pfSense CE versions up to 2.9.0 expose a local file read flaw. By assigning a file:// custom Update URL in the Dynamic DNS client configuration, an authenticated user with that privilege can read arbitrary files as root, such as /conf/config.xml or /etc/master.passwd, because the _checkStatus() routine logs file contents when the Result Match string does not match.

Affected Systems

The affected product is Netgate’s pfSense Community Edition. Versions including and up to 2.9.0 contain the vulnerability. All installations that allow the Dynamic DNS client to run with file:// URLs are impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate‑to‑high severity. The EPSS score of less than 1% shows a very low probability of being exploited in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires a local user with Dynamic DNS client privileges and the ability to configure the custom Update URL. An attacker who succeeds can read system files and potential credential data, but the attack vector is local and limited to accounts with that specific privilege.

Generated by OpenCVE AI on October 16, 2026 at 17:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a pfSense CE release newer than 2.9.0 that contains the local file read fix
  • Remove any file:// entries from the Dynamic DNS Update URL configuration or replace them with HTTPS URLs
  • Revoke or limit Dynamic DNS client privileges for users who do not need them
  • Adjust the Result Match setting to match expected successful status strings, or disable logging of file contents for file:// URLs

Generated by OpenCVE AI on October 16, 2026 at 17:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Title Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
First Time appeared Netgate
Netgate pfsense
Weaknesses CWE-73
CPEs cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*
Vendors & Products Netgate
Netgate pfsense
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Netgate Pfsense
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T19:48:31.710Z

Reserved: 2026-10-15T18:21:23.659Z

Link: CVE-2026-111230

cve-icon Vulnrichment

Updated: 2026-10-15T19:48:28.222Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T19:17:35.960

Modified: 2026-10-15T21:05:32.823

Link: CVE-2026-111230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T17:15:14Z

Weaknesses
  • CWE-73

    External Control of File Name or Path