CVE-2026-111217 is a High severity (CVSS 7.2) OS command injection in pfSense CE through 2.9.0. A user with Virtual IP edit rights can store a CARP VHID that runs commands as root. We found no fixed version, so limit who can edit Virtual IPs.
What's affected
The record says Netgate pfSense CE through 2.9.0 is affected. The researcher write-up says the review was of the public development tree for pfSense CE 2.9.0 at one commit, and notes that the PHP for the 2.9.0 release build was not on the public tree. We could not confirm whether shipped release builds contain the same code, and we found no Netgate advisory or fixed version, so check Netgate's channels.
The weakness is CWE-78, OS command injection. Per the record, an authenticated user with Virtual IP edit privileges can store a VHID value that is not validated. It then reaches a shell through the ifconfig calls in interface_ipalias_configure(), or through get_carp_interface_status() when CARP status is displayed.
Severity differs by source. The record gives 7.2 (High) with high privileges required. VulnCheck lists 8.6 on a CVSS 4.0 vector. The researcher write-up rates it 8.8 High on CVSS 3.1 and treats low privileges as enough. Our title follows the record, and all sources agree on High.
How to check if you're exposed
Check your pfSense CE version from the dashboard or the console.
cat /etc/version
Versions through 2.9.0 are in range per the record. Then look at your Virtual IPs under Firewall. A VHID should be a small whole number. Anything else in that field is a sign of tampering. Also review which accounts hold the Virtual IP editing privilege.
The researcher notes that the value can run later when CARP status is shown, for example on a dashboard widget, so a bad value that was saved earlier can fire on a later page view. Review saved Virtual IP entries even if you did not see any odd activity. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Review Virtual IP entries and correct any VHID that is not a plain number.
- Remove the Virtual IP editing privilege from accounts that do not need it.
- Restrict the WebGUI to a management network or VPN, and never expose it on the WAN.
- Watch Netgate's release notes and security announcements for a fix, and apply it when confirmed.
- Back up the configuration before changes, and compare the current configuration with an earlier backup to spot edits.
Why it matters
A VHID identifies a CARP group, and it is a number. The form treats it as one, but the server stored whatever it was given, and later code put it into shell commands in two places. One place was protected with escaping, and others were not. That mix is typical: a pattern is fixed where it was noticed and left in other call sites.
For a firewall, root access means control of all traffic it carries. The record requires a logged in account with specific privileges, which narrows who can try, but narrow grants are a common design in shared network teams. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which privileges are needed?
Per the record, Virtual IP edit privileges in the pfSense WebGUI.
Why do the scores differ?
The record gives 7.2 and the researcher gives 8.8 using different assumptions about the privileges needed. Both are High.
Sources
- VulnCheck advisory
- Researcher write-up on the CARP VHID issue
- Researcher write-up, pfSense CE leftovers
Last reviewed: 18 October 2026.
